PT-2008-4684 · Phpscheduleit · Phpscheduleit

Publicado 2008-07-24 · Atualizado 2017-08-08 · CVE-2008-3268

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: phpScheduleIt versions 1.2.0 through 1.2.9

Description: The issue allows remote attackers with knowledge of an administrator's email address to bypass restrictions and gain privileges. This is related to login names when the useLogonName feature is enabled.

Recommendations: For phpScheduleIt versions 1.2.0 through 1.2.9, consider disabling the useLogonName feature as a temporary workaround until a patch is available. Restrict access to administrator email addresses to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-3268

Produtos afetados

Phpscheduleit

Referências · 6

• http://sourceforge.net/project/shownotes.php?release_id=614202 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3268 · Nota
• http://secunia.com/advisories/31147 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3268 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43900 · Nota
• http://securityfocus.com/bid/30300 · Nota