Description

The file _vti_pvt/authors.pwd can be read. This file contains sensitive information and should not be available.

Remediation

Restrict access to this file be settings proper permissions to _vti_pvt directory or directly to authors.pwd.

References

Microsoft IIS Homepage

Related Vulnerabilities

Cookies with missing, inconsistent or contradictory properties

WordPress default administrator account

WordPress Plugin Social Network Tabs Information Disclosure (1.7.1)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions 'memberslist-csv.php' Information Disclosure (1.4.9)

WordPress Plugin WP PHP widget Information Disclosure (1.0.2)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure CWE-538