PT-2010-4949 · Mojoportal · Mojoportal

George Birbilis · Publicado 2010-09-24 · Atualizado 2017-08-17 · CVE-2010-3603

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mojoPortal versions 2.3.4.3 through 2.3.5.1

Description A cross-site request forgery (CSRF) issue exists in the file manager service, specifically in the Services/FileService.ashx endpoint. This allows remote attackers to hijack the authentication of administrators, enabling them to rename arbitrary files. For example, an attacker could cause the user.config file to be moved, resulting in a denial of service (service stop) and potentially exposing sensitive information.

Recommendations For versions 2.3.4.3 and 2.3.5.1, consider disabling the Services/FileService.ashx endpoint until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to the file manager service to minimize the risk of unauthorized file modifications.

Exploit

Correção

DoS

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2010-3603

Produtos afetados

Mojoportal

Referências · 10

• 🔥 http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txt · Exploit
• 🔥 http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdf · Exploit
• 🔥 https://exploit-db.com/exploits/15018 · Exploit
• 🔥 http://exploit-db.com/exploits/15018 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3603 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3603 · Nota
• http://osvdb.org/68060 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61834 · Nota
• http://secunia.com/advisories/41481 · Aviso do Fabricante
• http://mojoportal.com/mojoportal-2352-released.aspx · Aviso do Fabricante