EZ Publish 2.2.7/3.0 - site.ini Information Disclosure

Author: gregory Le Bras
type: remote
platform: windows
port: 
date_added: 2003-04-15  
date_updated: 2012-11-05  
verified: 1  
codes: OSVDB-6560  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 22488.txt  

source: https://www.securityfocus.com/bid/7347/info

eZ Publish has been reported prone to sensitive information disclosure vulnerability.

An attacker may make a request for and download the underlying site.ini configuration file. The file contains eZ Publish administration credentials stored in plaintext format. Any HTTP requests for this file will reveal the contents of this file to remote attackers.

http://[target]/settings/site.ini