PT-2010-1375 · Agoracart · Agoracart+1

Publicado 2010-01-04 · Atualizado 2017-08-17 · CVE-2009-4555

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AgoraCart versions 5.2.005 through 5.2.006 AgoraCart GOLD version 5.5.005

Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify a .htaccess file via an unspecified request to "protected/manager.cgi" or change the password of an administrative account. This is due to multiple cross-site request forgery (CSRF) vulnerabilities.

Recommendations For AgoraCart versions 5.2.005 through 5.2.006, consider restricting access to the "protected/manager.cgi" endpoint until a fix is available. For AgoraCart GOLD version 5.5.005, avoid using the administrative account password change feature until the issue is resolved. As a temporary workaround, consider implementing additional authentication measures to prevent unauthorized requests to sensitive endpoints.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4555

Produtos afetados

Agoracart

Agoracart Gold

Referências · 4

• http://secunia.com/advisories/36789 · Aviso do Fabricante
• http://holisticinfosec.org/content/view/129/45 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53808 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4555 · Nota de Segurança