PT-2008-3181 · Cern · Cds Invenio

Publicado 2008-04-02 · Atualizado 2017-08-08 · CVE-2008-1627

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions CDS Invenio versions 0.92.1 and earlier

Description The issue allows remote authenticated users to delete email notification alerts of arbitrary users by modifying the internal UID.

Recommendations For versions 0.92.1 and earlier, consider restricting access to the email notification alert system to prevent unauthorized deletion of alerts until a fix is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-1627

Produtos afetados

Cds Invenio

Referências · 6

• http://secunia.com/advisories/29521 · Aviso do Fabricante
• http://cdsware.cern.ch/invenio/news.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41546 · Nota
• http://securityfocus.com/bid/28514 · Nota
• http://cdsware.cern.ch/lists/project-cdsware-announce/archive/msg00021.shtml · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-1627 · Nota de Segurança