PT-2006-6654 · Webevents · Webevents

Ajann · Publicado 2006-11-21 · Atualizado 2018-10-17 · CVE-2006-6007

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebEvents (Online Event Registration Template) versions 2.0 and earlier

Description The issue allows remote attackers to modify user profiles, passwords, and other information for any user by manipulating the UserID parameter in the save profile.asp file.

Recommendations For WebEvents (Online Event Registration Template) versions 2.0 and earlier, avoid using the UserID parameter in the save profile.asp file until a fix is available. Consider restricting access to the save profile.asp file to prevent unauthorized modifications.

Correção

Identificadores relacionados

CVE-2006-6007

Produtos afetados

Webevents

Referências · 3

• http://securityfocus.com/archive/1/451411/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6007 · Nota de Segurança
• http://securityreason.com/securityalert/1888 · Nota