CVEvulnerability

CVE-2006-0754

5.0 MEDIUM Published 2006-02-18 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2006-02-18
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php

Affected configurations

• dotproject dotproject 2.0 • dotproject dotproject 2.0.1

References

http://secunia.com/advisories/18879 Vendor Advisory
http://www.osvdb.org/23206 www.osvdb.org
http://www.securityfocus.com/archive/1/424957/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/archive/1/425285/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/bid/16648 Exploit
http://www.vupen.com/english/advisories/2006/0604 www.vupen.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/24745 exchange.xforce.ibmcloud.com
http://secunia.com/advisories/18879 Vendor Advisory
http://www.osvdb.org/23206 www.osvdb.org
http://www.securityfocus.com/archive/1/424957/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/archive/1/425285/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/bid/16648 Exploit
http://www.vupen.com/english/advisories/2006/0604 www.vupen.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/24745 exchange.xforce.ibmcloud.com