PT-2007-3570 · University Of Michigan · Cosign

Publicado 2007-04-25 · Atualizado 2018-10-16 · CVE-2007-2233

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cosign versions 2.0.2 and earlier

Description The issue allows remote authenticated users to perform unauthorized actions as an arbitrary user. This is achieved by using CR (r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

Recommendations For Cosign versions 2.0.2 and earlier, update to a version later than 2.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the cosign-bin/cosign.cgi script to minimize the risk of exploitation. Avoid using the service parameter in the affected script until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-2233

Produtos afetados

Cosign

Referências · 6

• 🔥 https://exploit-db.com/exploits/29844 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2233 · Nota de Segurança
• http://secunia.com/advisories/24845 · Aviso do Fabricante
• http://umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1359 · Nota
• http://securityfocus.com/archive/1/465386/100/100/threaded · Nota