PT-2001-2124 · Surf Net · Surf-Net Asp Forum

Published 2001-08-31 · Updated 2017-07-11 · CVE-2001-0972

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Surf-Net ASP Forum versions prior to 2.30

Description The issue allows remote attackers to gain administrative privileges by calculating the value of the admin cookie, which is based on the UserID. The admin cookie can be calculated using the UserID 1.

Recommendations For versions prior to 2.30, consider updating to version 2.30 or later to resolve the issue. As a temporary workaround, restrict access to administrative functions to minimize the risk of exploitation. Avoid using easily guessable cookies based on the UserID until the issue is resolved.

Fix

Related Identifiers

CVE-2001-0972

Affected Products

Surf-Net Asp Forum

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2001-0972 · Security Note
• http://securityfocus.com/bid/3210 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=99834088223352&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7011 · Note