PT-2010-2711 · Pulse · Pulse Cms

Publicado 2010-03-26 · Atualizado 2018-10-10 · CVE-2010-0988

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pulse CMS versions prior to 1.2.3

Description The issue involves multiple unspecified vulnerabilities. These vulnerabilities allow remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php. Additionally, remote authenticated users can write to arbitrary files and execute arbitrary PHP code via vectors involving the filename and block parameters to view.php.

Recommendations For Pulse CMS versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/login.php and view.php files until a patch is available. Avoid using the filename and block parameters in the view.php file until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-0988

Produtos afetados

Pulse Cms

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0988 · Nota
• http://osvdb.org/63168 · Nota
• http://osvdb.org/63166 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0988 · Nota de Segurança
• http://securityfocus.com/archive/1/510300/100/0/threaded · Nota
• http://secunia.com/advisories/39011 · Aviso do Fabricante
• http://securityfocus.com/bid/38956 · Nota
• http://securityfocus.com/archive/1/510299/100/0/threaded · Nota
• http://secunia.com/secunia_research/2010-51 · Aviso do Fabricante
• http://secunia.com/secunia_research/2010-45 · Aviso do Fabricante