PT-2003-1732 · Digi · Digi-News

Arnaud Jacques + 1 · Publicado 2003-08-18 · Atualizado 2016-10-18 · CVE-2003-0588

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Digi-news version 1.1

Description: The issue allows remote attackers to bypass authentication. This is achieved by setting the username variable in a cookie to the name of the administrator. The admin.php file contains an improper condition that does not require a correct password, thus allowing unauthorized access.

Recommendations: For Digi-news version 1.1, consider temporarily disabling the admin.php file until a patch is available to prevent exploitation. Restrict access to the admin.php file to minimize the risk of unauthorized access. Avoid using the username variable in the cookie to authenticate users until the issue is resolved.

Correção

Identificadores relacionados

CVE-2003-0588

Produtos afetados

Digi-News

Referências · 2

• http://marc.info/?l=bugtraq&m=105839007002993&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0588 · Nota de Segurança