Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

FreeStyle Wiki exposes passwords through web‑accessible file

CVE-2006-6889 · published 19 years ago
Summary

Versions up to 3.6.2 of FreeStyle Wiki keep a file that contains user passwords in a location that can be reached over the internet. Because the file is not properly protected, anyone who knows the URL can download it and see the passwords. Update the software to a newer version or move the file to a location that is not publicly reachable and restrict access to it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
freestyle freestyle_wiki <= 3.6.2
cpe:2.3:a:freestyle:freestyle_wiki:*:*:*:*:*:*:*:*
Original advisory text
FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request fo...
FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request for config/user.dat.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Timeline
Published31 Dec 2006
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-6889 · NVD
Track software like this
Free during beta