PT-2007-1966 · Project · Office Project

Publicado 2007-01-26 · Atualizado 2017-07-29 · CVE-2007-0506

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Project issue tracking versions 4.7.0 through 5.x before 20070123

Description The issue allows remote authenticated users to bypass other access control modules. This is achieved by guessing the filename to obtain attached files and by making direct requests to obtain issue information. The project issue access function is involved in this issue.

Recommendations For versions 4.7.0 through 5.x before 20070123, consider restricting access to the project issue access function until a fix is available. Additionally, limiting direct requests to issue information and securing file attachments can help mitigate the risk.

Correção

Identificadores relacionados

CVE-2007-0506

Produtos afetados

Office Project

Referências · 7

• http://drupal.org/node/112146 · Aviso do Fabricante
• http://osvdb.org/32135 · Nota
• http://vupen.com/english/advisories/2007/0312 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0506 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31727 · Nota
• http://secunia.com/advisories/23887 · Nota
• http://securityfocus.com/bid/22224 · Nota