PT-2007-2670 · C1 Financial Services · C1 Financial Services Contelligent

Published 2007-03-03 · Updated 2017-07-29 · CVE-2007-1249

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions C1 Financial Services Contelligent version 9.1.4

Description The issue concerns the MoveSortedContentAction in C1 Financial Services Contelligent, which fails to check the additional environment security configuration. This oversight allows remote attackers with write permissions to reorder components.

Recommendations For version 9.1.4, consider restricting write permissions to prevent unauthorized component reordering until a patch is available. As a temporary workaround, review and monitor environment security configurations closely to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2007-1249

Affected Products

C1 Financial Services Contelligent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1249 · Security Note
• http://secunia.com/advisories/24364 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0814 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32775 · Note
• http://contelligent.com/contell/cms/c1web/contelligent/site/contelligent/changelog.html?fromRelease=9.1.4 · Note
• http://osvdb.org/33497 · Note
• http://securityfocus.com/bid/22785 · Note