CVE-2005-0820

Microsoft Office InfoPath 2003 SP1 includes sensitive information in the Manifest.xsf file in a custom .xsn form, which allows attackers to obtain printer and network information, obtain the database name, username, and password, or obtain the internal web server name.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://support.microsoft.com/kb/867443	Vendor Advisory
http://www.securityfocus.com/bid/12824
http://www.osvdb.org/14882
http://securitytracker.com/id?1013454

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:office_infopath:2003:sp1:*:*:*:*:*:*

Information

Published : 2005-05-01 21:00

Updated : 2008-09-05 13:47

NVD link : CVE-2005-0820

Mitre link : CVE-2005-0820

JSON object : View

CWE

NVD-CWE-Other

Products Affected

microsoft

office_infopath

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://support.microsoft.com/kb/867443", "name": "867443", "tags": ["Vendor Advisory"], "refsource": "MSKB"}, {"url": "http://www.securityfocus.com/bid/12824", "name": "12824", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/14882", "name": "14882", "tags": [], "refsource": "OSVDB"}, {"url": "http://securitytracker.com/id?1013454", "name": "1013454", "tags": [], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Microsoft Office InfoPath 2003 SP1 includes sensitive information in the Manifest.xsf file in a custom .xsn form, which allows attackers to obtain printer and network information, obtain the database name, username, and password, or obtain the internal web server name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-0820", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-05-02T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:office_infopath:2003:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-05T20:47Z"}

5.0 /10