PT-2005-1882 · Betaparticle · Betaparticle Blog

Publicado 2005-03-24 · Atualizado 2017-07-11 · CVE-2005-0854

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions betaparticle blog (bp blog) versions prior to 4

Description The issue allows remote attackers to bypass authentication. This can lead to two main consequences: (1) uploading files via a direct request to "upload.asp" (2) deleting files via a direct request to "myFiles.asp".

Recommendations For versions prior to 4, as a temporary workaround, consider restricting access to the "upload.asp" and "myFiles.asp" endpoints until a patch is available. Avoid using these endpoints in your workflow until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-0854

Produtos afetados

Betaparticle Blog

Referências · 8

• 🔥 https://exploit-db.com/exploits/25253 · Exploit
• 🔥 http://securityfocus.com/bid/12861 · Exploit
• 🔥 https://exploit-db.com/exploits/25254 · Exploit
• http://secunia.com/advisories/14668 · Aviso do Fabricante
• http://seclists.org/lists/bugtraq/2005/Mar/0360.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0854 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19781 · Nota
• http://blog.betaparticle.com/template_permalink.asp?id=68 · Nota