PT-2008-3036 · Gallarific · Gallarific Free Edition

Publicado 2008-03-24 · Atualizado 2011-07-25 · CVE-2008-1469

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallarific Free Edition version 1.1

Description The issue allows remote attackers to edit objects without authentication via direct requests to certain API endpoints, specifically "photos.php", "comments.php", and "gallery.php" in the "gadmin/" directory.

Recommendations For Gallarific Free Edition version 1.1, consider restricting access to the "gadmin/" directory and its contents, specifically the "photos.php", "comments.php", and "gallery.php" endpoints, until a proper authentication mechanism is implemented. As a temporary workaround, restrict direct requests to these endpoints to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-1469

Produtos afetados

Gallarific Free Edition

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2008-1469 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1469 · Nota
• http://secunia.com/advisories/29399 · Aviso do Fabricante