PT-2014-3268 · Burden · Burden

Publicado 2014-01-26 · Atualizado 2022-04-06 · CVE-2013-7137

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Burden versions prior to 1.8.1

Description The issue concerns the "remember me" functionality in login.php, allowing remote attackers to bypass authentication and gain privileges. This is achieved by setting the burden user rememberme cookie to 1.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the "remember me" functionality in login.php until a patch is available. Restrict access to the login.php module to minimize the risk of exploitation. Avoid using the burden user rememberme cookie in the affected login functionality until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-7137

Produtos afetados

Burden

Referências · 9

• 🔥 https://exploit-db.com/exploits/30916 · Exploit
• 🔥 http://exploit-db.com/exploits/30916 · Exploit
• https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1 · Correção
• https://github.com/joshf/Burden/issues/2 · Correção
• https://github.com/joshf/Burden/releases/tag/1.8.1 · Nota
• https://htbridge.com/advisory/HTB23192 · Nota
• https://t.me/cvenotify/27029 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2013-7137 · Nota de Segurança
• http://securityfocus.com/archive/1/530703/100/0/threaded · Nota