PT-2003-2432 · Phorum · Phorum

Webmaster · Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1487

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Phorum versions 3.4 through 3.4.2

Description The issue allows remote attackers to execute arbitrary commands and modify configuration files. This can be achieved via the UserAdmin program, Edit user profile, or stats program.

Recommendations For Phorum versions 3.4 through 3.4.2, consider disabling the UserAdmin program, Edit user profile, and stats program until a patch is available to prevent command injection attacks. Restrict access to these components to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2003-1487

Produtos afetados

Phorum

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/12500 · Nota
• http://securityfocus.com/archive/1/321310 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1487 · Nota
• http://securityreason.com/securityalert/3288 · Nota
• http://securityfocus.com/bid/7574 · Correção
• http://securityfocus.com/bid/7578 · Correção
• http://securityfocus.com/bid/7579 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1487 · Nota de Segurança