PT-2007-6205 · Flatnuke · Flatnuke

Publicado 2007-09-26 · Atualizado 2018-10-15 · CVE-2007-5109

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatNuke versions 2.6 through 3

Description A cross-site request forgery (CSRF) issue allows remote attackers to change the password and privilege level of arbitrary accounts. This is achieved via the user parameter and modified regpass and level parameters in a none Login action.

Recommendations For FlatNuke versions 2.6 through 3, as a temporary workaround, consider restricting access to the none Login action in index.php to minimize the risk of exploitation. Avoid using the regpass and level parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-5109

Produtos afetados

Flatnuke

Referências · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2007-5109 · Aviso do Fabricante
• http://securityfocus.com/bid/25817 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36763 · Nota
• http://securityfocus.com/archive/1/480468/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5109 · Nota de Segurança
• http://securityreason.com/securityalert/3176 · Nota
• https://ubuntu.com/security/CVE-2007-5109 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2007-5109 · Nota de Segurança
• http://secunia.com/advisories/26957 · Nota