PT-2009-2183 · Xecms · Xecms

T0Pp8Uzz · Publicado 2009-04-10 · Atualizado 2021-03-05 · CVE-2008-6714

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xeCMS versions 1.0.0 RC2 and earlier

Description The issue allows remote attackers to bypass authentication and access the admin panel by setting the xecms username cookie. This enables unauthorized access to the admin panel.

Recommendations For xeCMS versions 1.0.0 RC2 and earlier, as a temporary workaround, consider restricting access to the admin panel until a patch is available. Avoid using the xecms username cookie in the affected admin.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-6714

Produtos afetados

Xecms

Referências · 5

• 🔥 http://securityfocus.com/bid/29740 · Exploit
• 🔥 https://exploit-db.com/exploits/5818 · Exploit
• https://t.me/cvenotify/10935 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43114 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6714 · Nota de Segurança