oss-security - Re: CVE request: phpwebgallery

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Fri, 1 Aug 2008 09:56:18 +0200 (CEST)
From: "Pierre-Yves Rofes" <py@...too.org>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: phpwebgallery < 1.7.2

On Fri, August 1, 2008 1:49 am, Hanno Böck wrote:
> Changelog:
> http://bugs.phpwebgallery.net/changelog_page.php
>
> - 0000769: [security] Affichage des adresses email des utilisateurs en
> mode
> adviser (Pat) - closed.
>
> Yeah, it is in french, but nevertheless it's a security issue. (maybe
> someone
> wants to write an english advisory)
>
Hi,

Even if it's probably easy to guess with or without a translator, the
ticket description says:

In advisor mode, users's e-mails are masked with the address
"advisor.mode@...ite"
But if the advisor clicks to edit the user's profile, he can access
his real address.

For those wondering what the "advisor mode" is, since it seems to be
documented only in french
(http://phpwebgallery.net/doc/doku.php/fr:fonctionnalites:conseiller),
this is actually a read-only access to the admin interface, for helping
out a user to configure the gallery. So this issue is basically an
information disclosure.

HTH,

-- 
Pierre-Yves Rofes
Gentoo Linux Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.