PT-2007-2353 · Jportal · Jportal

Publicado 2007-02-13 · Atualizado 2018-10-16 · CVE-2007-0912

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Jportal versions 2.3.1 and earlier

Description: A Cross-Site Request Forgery (CSRF) issue allows remote attackers to perform privileged actions as administrators. This is achieved by tricking the admin into accessing a URL with modified arguments to "admin/admin.adm.php".

Recommendations: For Jportal versions 2.3.1 and earlier, consider disabling access to the admin/admin.adm.php endpoint until a fix is available. Restrict access to administrative functions to minimize the risk of exploitation. Avoid using modified URLs that could trick administrators into performing unintended actions. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2007-0912

Produtos afetados

Jportal

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-0912 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32458 · Nota
• http://securityreason.com/securityalert/2239 · Nota
• http://securityfocus.com/archive/1/459827/100/0/threaded · Nota
• http://osvdb.org/33712 · Nota