PT-2009-6394 · Joomla · Kide Shoutbox

Publicado 2009-12-08 · Atualizado 2009-12-09 · CVE-2009-4232

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Kide Shoutbox (com kide) component version 0.4.6 for Joomla!

Description The issue is related to improper authentication, allowing remote attackers to post messages with an arbitrary account name. This can be achieved by sending an insertar action to the "index.php" endpoint.

Recommendations For version 0.4.6, consider restricting access to the insertar action in the index.php endpoint until a proper fix is available. As a temporary workaround, review and monitor all posted messages to prevent unauthorized content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-4232

Produtos afetados

Kide Shoutbox

Referências · 2

• http://secunia.com/advisories/37508 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4232 · Nota de Segurança