PT-2008-3981 · Z Blogphp · Blogphp

Publicado 2008-06-03 · Atualizado 2017-08-08 · CVE-2008-2524

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BlogPHP version 2.0

Description The issue allows remote attackers to bypass authentication and post messages or comments as an arbitrary user. This is achieved by modifying the blogphp username field in a cookie.

Recommendations For BlogPHP version 2.0, consider restricting access to authentication mechanisms until a patch is available. As a temporary workaround, avoid using the blogphp username field in cookies to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-2524

Produtos afetados

Blogphp

Referências · 5

• http://secunia.com/advisories/30165 · Aviso do Fabricante
• http://davidsopas.com/soapbox/blogphp.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2524 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42372 · Nota
• http://securityfocus.com/bid/29133 · Nota