PT-2007-4691 · Webapp · Webapp

Published 2007-06-26 · Updated 2008-11-15 · CVE-2007-3420

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the Random Cookie Password functionality in the loaduser function, specifically in the subs.pl file within the cgi-bin/cgi-lib directory of WebAPP. This functionality fails to clear certain cookies, including username, password, usertheme, and userlang, for unauthorized users. The impact and attack vectors of this issue are remote, but the specific effects are not detailed.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the loaduser function in subs.pl to minimize the risk of exploitation. Additionally, clearing the username, password, usertheme, and userlang cookies for unauthorized users can help mitigate the risk until a patch is applied.

Fix

Related Identifiers

CVE-2007-3420

Affected Products

Webapp

References · 4

• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3420 · Security Note
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Note
• http://osvdb.org/45401 · Note