PT-2007-6600 · Pligg · Pligg Cms

Publicado 2007-10-18 · Atualizado 2017-07-29 · CVE-2007-5579

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pligg CMS version 9.5

Description The issue concerns a password reset mechanism in Pligg CMS. Specifically, the login.php file uses a guessable confirmation code, allowing remote attackers with knowledge of a username to reset that user's password by calculating the confirmationcode parameter.

Recommendations For Pligg CMS version 9.5, consider temporarily disabling the password reset feature in login.php until a secure alternative is implemented to prevent exploitation. Restrict access to the login.php file to minimize the risk of unauthorized password resets. Avoid using the confirmationcode parameter in the password reset process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2007-5579

Produtos afetados

Pligg Cms

Referências · 7

• 🔥 http://securityfocus.com/bid/24158 · Exploit
• 🔥 https://exploit-db.com/exploits/30088 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2007-05/0383.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5579 · Nota de Segurança
• http://osvdb.org/42031 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34512 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5579 · Nota