PT-2014-5550 · Imember360 · Imember360

Everett Griffiths · Publicado 2014-05-23 · Atualizado 2014-05-27 · CVE-2014-3849

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions iMember360 plugin versions 3.8.012 through 3.9.001

Description The issue allows remote attackers to delete arbitrary users due to improper access restriction. This can be achieved by sending a request with a user name in the Email parameter and the API key in the i4w clearuser parameter.

Recommendations For iMember360 plugin versions 3.8.012 through 3.9.001, consider restricting access to the API endpoint that processes the i4w clearuser parameter until a patch is available. Avoid using the Email parameter with arbitrary user names in requests to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3849

Produtos afetados

Imember360

Referências · 7

• 🔥 https://exploit-db.com/exploits/33076 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Apr/265 · Exploit
• 🔥 http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html · Exploit
• 🔥 http://exploit-db.com/exploits/33076 · Exploit
• http://osvdb.org/106300 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3849 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3849 · Nota