« Volver al listado

CVE-2006-6112

Estado: ModificadaMedia (5)—

LifeType 1.0.x y 1.1.x tiene control de acceso insuficiente para todas las secuencias de comandos PHP bajo (1) class/ y (2) plugins/, lo cual permite a atacantes remotos obtener la ruta de instalación mediante una petición directa a alguna de las secuencias de comandos, como ha sido demostrado por (a) bayesianfilter.class.php y (b) bootstrap.php, lo cual filtra la ruta en un mensaje de error.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lifetype — Lifetype

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6112",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-06T22:28:00.000",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/1980",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.x",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.netvigilance.com/advisory0008",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/30685",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/453135/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30635",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1980",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.x",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.netvigilance.com/advisory0008",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/30685",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/453135/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30635",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by (a) bayesianfilter.class.php and (b) bootstrap.php, which leaks the path in an error message."
    },
    {
      "lang": "es",
      "value": "LifeType 1.0.x y 1.1.x tiene control de acceso insuficiente para todas las secuencias de comandos PHP bajo (1) class/ y (2) plugins/, lo cual permite a atacantes remotos obtener la ruta de instalación mediante una petición directa a alguna de las secuencias de comandos, como ha sido demostrado por (a) bayesianfilter.class.php y (b) bootstrap.php, lo cual filtra la ruta en un mensaje de error."
    }
  ],
  "lastModified": "2026-06-16T22:32:29.577",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1AC32F8-BA04-4607-8186-9A777560E03E"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10BB71F3-1B32-4CDF-84FB-F97F925D8D79"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1FC57F5-A442-4AAE-9E0C-8AAF1813B06F"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62DD0AA0-83FA-46A6-AE58-109060AEF195"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A58E0607-F801-406F-A717-8E8418062426"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "575162F0-CDCA-4F1D-9CDE-6F80927CFAAB"
            },
            {
              "criteria": "cpe:2.3:a:lifetype:lifetype:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63834C76-8FDE-4F95-9E33-528D51AEE941"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}