PT-2003-1732 · Digi · Digi-News

Arnaud Jacques + 1 · Published 2003-08-18 · Updated 2016-10-18 · CVE-2003-0588

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Digi-news version 1.1

Description: The issue allows remote attackers to bypass authentication. This is achieved by setting the username variable in a cookie to the name of the administrator. The admin.php file contains an improper condition that does not require a correct password, thus allowing unauthorized access.

Recommendations: For Digi-news version 1.1, consider temporarily disabling the admin.php file until a patch is available to prevent exploitation. Restrict access to the admin.php file to minimize the risk of unauthorized access. Avoid using the username variable in the cookie to authenticate users until the issue is resolved.

Fix

Related Identifiers

CVE-2003-0588

Affected Products

Digi-News

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2003-0588 · Security Note
• http://marc.info/?l=bugtraq&m=105839007002993&w=2 · Note