PT-2004-3622 · Web Wiz · Web Wiz Forums

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2733

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web Wiz Forums version 7.7a

Description The issue concerns invalid logic used to determine user privileges. This allows remote attackers to perform certain actions, including blocking arbitrary IP addresses via the "pop up ip blocking.asp" API endpoint or modifying topics via the "pop up topic admin.asp" API endpoint.

Recommendations For Web Wiz Forums version 7.7a, update to a version that addresses the privilege determination logic issue to prevent unauthorized actions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2004-2733

Affected Products

Web Wiz Forums

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2004-2733 · Security Note
• http://secunia.com/advisories/11525 · Vendor Advisory
• http://securitytracker.com/id?1010012 · Note
• http://osvdb.org/5750 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16030 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16031 · Note
• http://osvdb.org/5751 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-04/1119.html · Note
• http://securityfocus.com/bid/10255 · Note