PT-2005-4231 · Archilles · Archilles Newsworld

Chb + 1 · Publicado 2005-11-02 · Atualizado 2024-02-09 · CVE-2005-3435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Archilles Newsworld versions up to 1.3.0

Description The issue allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument. This can be achieved, for example, through another Newsworld vulnerability.

Recommendations For Archilles Newsworld versions up to 1.3.0, update to a version later than 1.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the admin news.php file to minimize the risk of exploitation. Avoid using the pwd argument in the admin news.php file until the issue is resolved.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2005-3435

Produtos afetados

Archilles Newsworld

Referências · 4

• http://marc.info/?l=bugtraq&m=113018731120709&w=2 · Nota
• http://secunia.com/advisories/17310 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22860 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3435 · Nota de Segurança