Description

The file _vti_pvt/authors.pwd can be read. This file contains sensitive information and should not be available.

Remediation

Restrict access to this file be settings proper permissions to _vti_pvt directory or directly to authors.pwd.

References

Microsoft IIS Homepage

Related Vulnerabilities

JBoss JMX Console Unrestricted Access

Magento Cacheleak

Adobe Experience Manager Misconfiguration

WordPress Plugin SKU Shortlink For WooCommerce Arbitrary File Disclosure (1.3.4)

WordPress Plugin Fusion Engage Local File Disclosure (1.0.5)

Severity

Medium

Classification

CWE-538 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Tags

Configuration Information Disclosure