PT-2006-1891 · Leif M. Wright · Leif M. Wright'S Blog

Aliaksandr Hartsuyeu · Published 2006-02-22 · Updated 2017-07-20 · CVE-2006-0844

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Leif M. Wright's Blog version 3.5

Description The issue allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie, due to the lack of password comparison when authenticating an administrator via a cookie.

Recommendations For version 3.5, consider disabling the use of the blogAdmin cookie for administrator authentication until a proper fix is implemented to enforce password comparison.

Fix

Related Identifiers

CVE-2006-0844

Affected Products

Leif M. Wright'S Blog

References · 6

• http://secunia.com/advisories/18923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0844 · Security Note
• http://evuln.com/vulns/82/summary.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24755 · Note
• http://securityfocus.com/bid/16714 · Note
• http://securityreason.com/securityalert/522 · Note