PT-2007-4690 · Webapp · Webapp

Publicado 2007-06-26 · Atualizado 2008-11-15 · CVE-2007-3419

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the editprofile3 function in cgi-bin/cgi-lib/user.pl, which fails to properly check several files, including themes.dat, languages.dat, profession.dat, gen.dat, marstat.dat, states.dat, and ages.dat, before saving member profile settings. This has an unknown impact and can be exploited remotely.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the editprofile3 function in cgi-bin/cgi-lib/user.pl until a patch is available. Additionally, restrict modifications to the files themes.dat, languages.dat, profession.dat, gen.dat, marstat.dat, states.dat, and ages.dat to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3419

Produtos afetados

Webapp

Referências · 4

• http://osvdb.org/45400 · Nota
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3419 · Nota de Segurança
• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Correção