PT-2003-2526 · Debian · Ecartis

Haluk Aydin · Published 1970-01-01 · Updated 2017-07-11 · CVE-2003-0162

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ecartis version 1.0.0

Description The issue allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page. Multiple vulnerabilities in the ecartis package of the Debian GNU/Linux operating system can be exploited remotely, leading to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For Ecartis version 1.0.0, consider disabling the password reset functionality until a patch is available. Restrict access to the affected HTML pages to minimize the risk of exploitation. Avoid using hidden form fields in the HTML page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02150

BDU:2015-02151

BDU:2015-02152

BDU:2015-02153

CVE-2003-0162

DSA-271

Affected Products

Ecartis

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2003-0162 · Security Note
• https://bdu.fstec.ru/vul/2015-02153 · Security Note
• https://bdu.fstec.ru/vul/2015-02151 · Security Note
• https://bdu.fstec.ru/vul/2015-02152 · Security Note
• http://securityfocus.com/bid/6971 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02150 · Security Note
• http://debian.org/security/2003/dsa-271 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0162 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11431 · Note
• http://marc.info/?l=bugtraq&m=104673407728323&w=2 · Note
• http://debian.org/security/dsa-271 · Note
• http://marc.info/?l=bugtraq&m=104636153214262&w=2 · Note