View Issue Details

IDProjectCategoryView StatusLast Update
0005206ardourbugspublic2012-12-05 23:27
ReporterParveen Assigned To 
Status newResolutionopen 
Product VersionSVN/2.0-ongoing 
Summary0005206: Open Directroy Listing Vulnerability
DescriptionBy this vulnerability any attacker could view all files in a given web directory. This allows them to see files which might not be linked anywhere on your site, including files which may include sensitive information, such as backup script files (like index.php~ or index.php.bak), htaccess files, or text files with notes (password.txt!) & here also by this vulnerability ,we can access the htacess and log files .
The other method is more dangerous. Some web servers are setup such that the web home is actually the user home, so passing in certain values in the web address can allow directory listings outside of the normally safe web folder structure. This is more dangerous since an attacker may be able to find and execute programs on your server through a web browser, potentially exploiting those programs as well.

Effected links:-

Additional InformationSecurity Risk :- If one or more directories holds a secret file, such as a password or key file, the attackers may be able to steal it. Additionally, directory traversal can sometimes allow attackers to access files outside the web root directory, leading to the stealing of system files, which can aid in other, additional attacks.
I hope this report will be considerd and the vulnerabilities will be patched as soon as possible.
For further asistance you can contact me on my mail i.d .
TagsNo tags attached.



2012-12-05 23:27

administrator   ~0014320

There are no files in that svn repository that contain protected information as far as I know.

index.php contains nothing. our PHP configuration is not stored in the repository and it read-protected on disk.

It probably is not ideal that .htaccess from 3 years ago is visible there.

Our server root is NOT a user home directory.

Issue History

Date Modified Username Field Change
2012-12-03 09:13 Parveen New Issue
2012-12-05 23:27 paul Note Added: 0014320