Test ID:	1.3.6.1.4.1.25623.1.0.900378
Category:	Web application abuses
Title:	OCS Inventory NG 'cvs.php' Information Disclosure Vulnerability
Summary:	OCS Inventory NG is prone to an information disclosure vulnerability.
Description:	Summary: OCS Inventory NG is prone to an information disclosure vulnerability. Vulnerability Insight: The flaw is due to improper sanitization of user supplied input through the 'cvs.php' file which can exploited by sending a direct request to the 'log' parameter. Vulnerability Impact: Successful exploitation will allow attacker to cause path traversal attack, and gain sensitive information. Affected Software/OS: OCS Inventory NG version prior to 1.02.1. Solution: Upgrade to OCS Inventory NG version 1.02.1 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2166 Bugtraq: 20090602 OCS Inventory NG 1.02 - Directory Traversal (Google Search) http://www.securityfocus.com/archive/1/504047/100/0/threaded https://www.exploit-db.com/exploits/8868 http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtml XForce ISS Database: ocsinventory-cvs-info-disclosure(50946) https://exchange.xforce.ibmcloud.com/vulnerabilities/50946
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.