PT-2009-6341 · Cutenews · Cutenews

Publicado 2009-12-02 · Atualizado 2018-10-10 · CVE-2009-4173

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews versions 1.4.6 and earlier, UTF-8 CuteNews versions prior to 8b

Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for creating new users, including administrators, by exploiting the adduser action in the editusers module in index.php.

Recommendations For CuteNews version 1.4.6 and earlier, update to a version later than 1.4.6. For UTF-8 CuteNews versions prior to 8b, update to version 8b or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4173

Produtos afetados

Cutenews

Referências · 7

• 🔥 http://securityfocus.com/bid/36971 · Exploit
• 🔥 https://exploit-db.com/exploits/10002 · Exploit
• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33344 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4173 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54240 · Nota
• http://securityfocus.com/archive/1/507782/100/0/threaded · Nota