PT-2003-2526 · Debian · Ecartis

Haluk Aydin · Publicado 1970-01-01 · Atualizado 2017-07-11 · CVE-2003-0162

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ecartis version 1.0.0

Description The issue allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page. Multiple vulnerabilities in the ecartis package of the Debian GNU/Linux operating system can be exploited remotely, leading to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For Ecartis version 1.0.0, consider disabling the password reset functionality until a patch is available. Restrict access to the affected HTML pages to minimize the risk of exploitation. Avoid using hidden form fields in the HTML page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-02150

BDU:2015-02151

BDU:2015-02152

BDU:2015-02153

CVE-2003-0162

DSA-271

Produtos afetados

Ecartis

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2003-0162 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02153 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02151 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11431 · Nota
• http://marc.info/?l=bugtraq&m=104673407728323&w=2 · Nota
• http://debian.org/security/dsa-271 · Nota
• https://bdu.fstec.ru/vul/2015-02152 · Nota de Segurança
• http://securityfocus.com/bid/6971 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-02150 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=104636153214262&w=2 · Nota
• http://debian.org/security/2003/dsa-271 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0162 · Nota de Segurança