PT-2001-2124 · Surf Net · Surf-Net Asp Forum

Publicado 2001-08-31 · Atualizado 2017-07-11 · CVE-2001-0972

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Surf-Net ASP Forum versions prior to 2.30

Description The issue allows remote attackers to gain administrative privileges by calculating the value of the admin cookie, which is based on the UserID. The admin cookie can be calculated using the UserID 1.

Recommendations For versions prior to 2.30, consider updating to version 2.30 or later to resolve the issue. As a temporary workaround, restrict access to administrative functions to minimize the risk of exploitation. Avoid using easily guessable cookies based on the UserID until the issue is resolved.

Correção

Identificadores relacionados

CVE-2001-0972

Produtos afetados

Surf-Net Asp Forum

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2001-0972 · Nota de Segurança
• http://securityfocus.com/bid/3210 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=99834088223352&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7011 · Nota