CVE-2006-3365 : V3 Chat allows remote attackers to obtain the installation path via (1) an inval

V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.

Published 2006-07-06 20:05:00

Updated 2018-10-18 16:47:05

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2006-3365

V3 Chat » V3 Chat » Version: Beta
cpe:2.3:a:v3_chat:v3_chat:beta:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2006-3365

EPSS FAQ

0.57%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 67 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-3365

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.6	LOW	AV:N/AC:H/Au:N/C:P/I:N/A:N	4.9	2.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2006-3365

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2006-3365

Jump to

Vulnerability Details : CVE-2006-3365

Products affected by CVE-2006-3365

Exploit prediction scoring system (EPSS) score for CVE-2006-3365

CVSS scores for CVE-2006-3365

CWE ids for CVE-2006-3365

References for CVE-2006-3365