PT-2006-1194 · Joomla · Joomla!

Publicado 2006-01-09 · Atualizado 2017-07-20 · CVE-2006-0114

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Joomla! version 1.0.5

Description: The issue concerns the vCard functions, which use predictable sequential IDs for vcards and do not restrict access to them. This allows remote attackers to obtain valid e-mail addresses by modifying the contact id parameter to "index2.php" API endpoint, potentially leading to spam attacks.

Recommendations: For Joomla! version 1.0.5, restrict access to the vCard functions to prevent unauthorized access, and consider modifying the contact id parameter handling in the "index2.php" API endpoint to prevent manipulation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-0114

Produtos afetados

Joomla!

Referências · 9

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0114 · Nota
• http://vupen.com/english/advisories/2006/0097 · Aviso do Fabricante
• http://secunia.com/advisories/18361 · Aviso do Fabricante
• http://listerit.com/content/view/116/84 · Nota
• http://securityfocus.com/bid/16185 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24042 · Nota
• http://forum.joomla.org/index.php/topic%2C29031.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0114 · Nota de Segurança
• http://forge.joomla.org/sf/go/artf2950 · Nota