PT-2007-3019 · Phprojekt · Phprojekt

Publicado 2007-03-23 · Atualizado 2018-10-16 · CVE-2007-1638

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHProjekt version 5.2.0

Description: The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the check csrftoken function. These vulnerabilities allow remote attackers to perform unauthorized actions as an arbitrary user via various modules, including Projects, Contacts, Helpdesk, Notes, Search, Mail, or Filemanager, as well as the summary page and other unspecified files, when magic quotes gpc is disabled.

Recommendations: For PHProjekt version 5.2.0, consider disabling the check csrftoken function temporarily until a patch is available, or apply configuration changes to enable magic quotes gpc to mitigate the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1638

Produtos afetados

Phprojekt

Referências · 10

• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Nota
• http://osvdb.org/35162 · Nota
• http://secunia.com/advisories/25748 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1638 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Aviso do Fabricante
• http://secunia.com/advisories/24509 · Aviso do Fabricante
• http://securityfocus.com/archive/1/462786/100/100/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32989 · Nota
• http://nruns.de/security_advisory_phprojekt_csrf.php · Nota
• http://securityreason.com/securityalert/2477 · Nota