PT-2007-2353 · Jportal · Jportal

Published 2007-02-13 · Updated 2018-10-16 · CVE-2007-0912

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Jportal versions 2.3.1 and earlier

Description: A Cross-Site Request Forgery (CSRF) issue allows remote attackers to perform privileged actions as administrators. This is achieved by tricking the admin into accessing a URL with modified arguments to "admin/admin.adm.php".

Recommendations: For Jportal versions 2.3.1 and earlier, consider disabling access to the admin/admin.adm.php endpoint until a fix is available. Restrict access to administrative functions to minimize the risk of exploitation. Avoid using modified URLs that could trick administrators into performing unintended actions. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-0912

Affected Products

Jportal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-0912 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32458 · Note
• http://securityreason.com/securityalert/2239 · Note
• http://securityfocus.com/archive/1/459827/100/0/threaded · Note
• http://osvdb.org/33712 · Note