PT-2007-3914 · Rsa · Rsauction

Publicado 2007-05-11 · Atualizado 2017-07-29 · CVE-2007-2595

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RSAuction version 2.73.1.3

Description The issue allows remote authenticated users to change their account status from Suspended to Active by directly requesting the activation URL provided during account registration.

Recommendations For RSAuction version 2.73.1.3, consider restricting access to the account activation URL to prevent unauthorized account status changes until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2007-2595

Produtos afetados

Rsauction

Referências · 5

• http://secunia.com/advisories/25149 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2595 · Nota de Segurança
• http://osvdb.org/35870 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34192 · Nota
• http://securityfocus.com/bid/23895 · Nota