PT-2011-2891 · Simple Machines · Simple Machines Forum

Hanno Böck · Publicado 2011-06-21 · Atualizado 2011-06-29 · CVE-2011-1127

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions 1.1.x through 1.1.12 Simple Machines Forum (SMF) versions 2.x through 2.0 RC4

Description The issue is related to the SSI.php file in Simple Machines Forum (SMF), which does not properly restrict guest access. This allows remote attackers to have an unspecified impact via unknown vectors.

Recommendations For Simple Machines Forum (SMF) versions 1.1.x through 1.1.12, update to version 1.1.13 or later. For Simple Machines Forum (SMF) versions 2.x through 2.0 RC4, update to version 2.0 RC5 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1127

Produtos afetados

Simple Machines Forum

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-1127 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/03/02/4 · Correção
• http://openwall.com/lists/oss-security/2011/02/22/17 · Correção
• http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1127 · Nota
• http://simplemachines.org/community/index.php?topic=421547.0 · Correção