PT-2009-2655 · Clipshare · Clipshare

Pr0Metheus · Publicado 2009-09-09 · Atualizado 2017-09-29 · CVE-2008-7188

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClipShare version 2.6

Description The issue allows remote attackers to change the profile of arbitrary users by modifying the uid variable in the "siteadmin/useredit.php" endpoint. This can be exploited to recover a user's password by using a modified e-mail address in the email parameter to "recoverpass.php".

Recommendations For ClipShare version 2.6, consider restricting access to the "siteadmin/useredit.php" and "recoverpass.php" endpoints until a proper fix is available. As a temporary workaround, restrict the use of the uid variable and the email parameter in these endpoints to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-7188

Produtos afetados

Clipshare

Referências · 6

• 🔥 https://exploit-db.com/exploits/4837 · Exploit
• 🔥 http://securityfocus.com/bid/27148 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39494 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7188 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7188 · Nota de Segurança
• http://secunia.com/advisories/28313 · Aviso do Fabricante