PT-2004-3622 · Web Wiz · Web Wiz Forums

Publicado 2004-12-31 · Atualizado 2017-07-29 · CVE-2004-2733

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web Wiz Forums version 7.7a

Description The issue concerns invalid logic used to determine user privileges. This allows remote attackers to perform certain actions, including blocking arbitrary IP addresses via the "pop up ip blocking.asp" API endpoint or modifying topics via the "pop up topic admin.asp" API endpoint.

Recommendations For Web Wiz Forums version 7.7a, update to a version that addresses the privilege determination logic issue to prevent unauthorized actions.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2004-2733

Produtos afetados

Web Wiz Forums

Referências · 9

• http://securitytracker.com/id?1010012 · Nota
• http://osvdb.org/5750 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2733 · Nota de Segurança
• http://secunia.com/advisories/11525 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16030 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16031 · Nota
• http://osvdb.org/5751 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2004-04/1119.html · Nota
• http://securityfocus.com/bid/10255 · Nota