PT-2006-6576 · Paul Tarjan Stanford Conference Research Forum · Scarf

Published 2006-11-15 · Updated 2018-10-17 · CVE-2006-5909

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Paul Tarjan Stanford Conference And Research Forum (SCARF) versions prior to 20070227

Description The issue allows remote attackers to reconfigure the application or its user accounts without requiring admin privileges. This is due to a lack of proper access control in the generaloptions.php file.

Recommendations For versions prior to 20070227, update to a version released after 20070227 to ensure proper access controls are in place. As a temporary workaround, consider restricting access to the generaloptions.php file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-5909

Affected Products

Scarf

References · 9

• http://vupen.com/english/advisories/2007/0760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5909 · Security Note
• http://secunia.com/advisories/24311 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32700 · Note
• http://securityfocus.com/archive/1/460196/100/0/threaded · Note
• http://securityfocus.com/bid/20934 · Note
• http://securityfocus.com/archive/1/450679/100/0/threaded · Note
• http://sourceforge.net/project/shownotes.php?group_id=177652&release_id=489633 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30037 · Note