PT-2008-6363 · Unknown · Wportfolio

G4N0K · Publicado 2008-11-25 · Atualizado 2017-09-29 · CVE-2008-5221

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions wPortfolio versions 0.3 and earlier

Description The issue concerns the account save action in the admin/userinfo.php file, which does not require authentication and does not demand knowledge of the original password. This allows remote attackers to change the admin account password by modifying the password and password retype parameters.

Recommendations For wPortfolio versions 0.3 and earlier, consider disabling the account save action in admin/userinfo.php until a patch is available. Restrict access to the admin/userinfo.php file to minimize the risk of exploitation. Avoid using the password and password retype parameters in the affected action until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-5221

Produtos afetados

Wportfolio

Referências · 6

• 🔥 https://exploit-db.com/exploits/7170 · Exploit
• 🔥 http://securityfocus.com/bid/32384 · Exploit
• http://vupen.com/english/advisories/2008/3219 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5221 · Nota de Segurança
• http://securityreason.com/securityalert/4631 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46772 · Nota