PT-2014-8946 · Snowfox · Snowfox Cms

Publicado 2014-12-08 · Atualizado 2017-09-08 · CVE-2014-9343

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Snowfox CMS version 1.0

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the rd parameter in a submit action to "snowfox/".

Recommendations For Snowfox CMS version 1.0, consider restricting access to the selectlanguage.class.php module until a patch is available. As a temporary workaround, avoid using the rd parameter in the affected submit action to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2014-9343

Produtos afetados

Snowfox Cms

Referências · 7

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5206.php · Exploit
• 🔥❌ https://github.com/GlobizSolutions/snowfox/commit/55a8e44a9d9a9a788cc1cde6baf0c2c67e0c736a · Exploit, Deleted
• ❌ https://github.com/GlobizSolutions/snowfox/releases · Nota, Deleted
• http://osvdb.org/show/osvdb/114850 · Nota
• http://packetstormsecurity.com/files/129162/Snowfox-CMS-1.0-Open-Redirect.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99128 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9343 · Nota de Segurança