PT-2004-2920 · Zen Cart · Zen Cart

Published 2004-12-31 · Updated 2008-09-05 · CVE-2004-2024

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zen Cart version 1.1.4 before patch 2

Description The issue concerns the Admin password retrieval functionality in Zen Cart, where certain debugging code is present. This allows attackers to gain administrative privileges via the "password forgotten.php" endpoint.

Recommendations For Zen Cart version 1.1.4 before patch 2, apply patch 2 to resolve the issue. As a temporary workaround, consider restricting access to the "password forgotten.php" endpoint until the patch is applied.

Fix

Related Identifiers

CVE-2004-2024

Affected Products

Zen Cart

References · 4

• http://zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateD · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2024 · Security Note
• http://zen-cart.com/modules/ipb/index.php?showtopic=4873 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2024 · Note