PT-2006-1891 · Leif M. Wright · Leif M. Wright'S Blog

Aliaksandr Hartsuyeu · Publicado 2006-02-22 · Atualizado 2017-07-20 · CVE-2006-0844

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Leif M. Wright's Blog version 3.5

Description The issue allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie, due to the lack of password comparison when authenticating an administrator via a cookie.

Recommendations For version 3.5, consider disabling the use of the blogAdmin cookie for administrator authentication until a proper fix is implemented to enforce password comparison.

Correção

Identificadores relacionados

CVE-2006-0844

Produtos afetados

Leif M. Wright'S Blog

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/24755 · Nota
• http://secunia.com/advisories/18923 · Aviso do Fabricante
• http://securityfocus.com/bid/16714 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0844 · Nota de Segurança
• http://evuln.com/vulns/82/summary.html · Aviso do Fabricante
• http://securityreason.com/securityalert/522 · Nota