PT-2011-3497 · Unknown · Post Revolution

Javier Bassi · Publicado 2011-06-06 · Atualizado 2018-10-09 · CVE-2011-1954

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Post Revolution versions 0.8.0c-2 and earlier

Description The issue allows remote attackers to hijack the authentication of arbitrary users for requests to specific API endpoints, including "ajax-weblog-guardar.php", "verpost.php", "comments.php", and "perfil.php".

Recommendations For Post Revolution versions 0.8.0c-2 and earlier, as a temporary workaround, consider restricting access to the affected API endpoints until a patch is available. Avoid using the affected endpoints in "ajax-weblog-guardar.php", "verpost.php", "comments.php", and "perfil.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-1954

Produtos afetados

Post Revolution

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1954 · Nota
• http://javierb.com.ar/2011/06/01/postrev-vunls · Nota
• http://postrev.com.ar/verpost.php?id_noticia=59 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1954 · Nota de Segurança
• http://securityfocus.com/archive/1/518205/100/0/threaded · Nota
• http://securityreason.com/securityalert/8270 · Nota
• http://osvdb.org/72641 · Nota
• http://secunia.com/advisories/44710 · Nota