PT-2003-1590 · Vignette · Vignette Storyserver+1
Ramon Pinuaga Cascales
·
Publicado
2003-06-11
·
Atualizado
2016-10-18
·
CVE-2003-0399
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Vignette StoryServer versions 4 and 5
Vignette V/5
Description:
The issue allows remote attackers to perform unauthorized SELECT queries. This can be achieved by setting the
vgn creds cookie to an arbitrary value and directly accessing the save template.Recommendations:
For Vignette StoryServer versions 4 and 5, consider restricting access to the save template to prevent unauthorized SELECT queries.
For Vignette V/5, restrict access to the save template to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Vignette Storyserver
Vignette V/5