PT-2007-4030 · Ifdate · Ifdate

Published 2007-05-16 · Updated 2018-10-16 · CVE-2007-2713

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ifdate versions 2.x

Description The issue allows remote attackers to obtain administrative access via a direct request for the "admin/" URI, because ifdate sends a redirect to the web browser but does not exit when administrative credentials are missing.

Recommendations For ifdate version 2.x, consider restricting access to the admin/ URI until a fix is available. As a temporary workaround, ensure that administrative credentials are properly validated to prevent unauthorized access.

Fix

Related Identifiers

CVE-2007-2713

Affected Products

Ifdate

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-2713 · Security Note
• http://securityfocus.com/archive/1/468545/100/0/threaded · Note
• http://expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html · Note
• http://secunia.com/advisories/25237 · Note
• http://osvdb.org/36173 · Note
• http://securityfocus.com/bid/23971 · Note
• http://securityreason.com/securityalert/2707 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34257 · Note