PT-2006-1194 · Joomla · Joomla!

Published 2006-01-09 · Updated 2017-07-20 · CVE-2006-0114

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Joomla! version 1.0.5

Description: The issue concerns the vCard functions, which use predictable sequential IDs for vcards and do not restrict access to them. This allows remote attackers to obtain valid e-mail addresses by modifying the contact id parameter to "index2.php" API endpoint, potentially leading to spam attacks.

Recommendations: For Joomla! version 1.0.5, restrict access to the vCard functions to prevent unauthorized access, and consider modifying the contact id parameter handling in the "index2.php" API endpoint to prevent manipulation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-0114

Affected Products

Joomla!

References · 9

• http://vupen.com/english/advisories/2006/0097 · Vendor Advisory
• http://secunia.com/advisories/18361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0114 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0114 · Note
• http://listerit.com/content/view/116/84 · Note
• http://securityfocus.com/bid/16185 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24042 · Note
• http://forum.joomla.org/index.php/topic%2C29031.0.html · Note
• http://forge.joomla.org/sf/go/artf2950 · Note