PT-2014-2909 · Openpne · Openpne

Egidio Romano · Publicado 2014-01-24 · Atualizado 2014-01-24 · CVE-2013-5350

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenPNE versions 3.6.13 through 3.6.13 OpenPNE versions 3.8.9 through 3.8.9

Description The issue concerns the "Remember me" feature, which does not properly validate login data in HTTP Cookie headers. This allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Recommendations For OpenPNE versions 3.6.13 through 3.6.13, update to version 3.6.13.1 to resolve the issue. For OpenPNE versions 3.8.9 through 3.8.9, update to version 3.8.9.1 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-5350

Produtos afetados

Openpne

Referências · 6

• http://secunia.com/advisories/54043 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN69986880/index.html · Nota
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5350 · Nota de Segurança
• https://openpne.jp/archives/12293 · Aviso do Fabricante
• http://secunia.com/secunia_research/2014-1 · Aviso do Fabricante