PT-2007-4692 · Web App.Org · Webapp

Published 2007-06-26 · Updated 2008-11-15 · CVE-2007-3421

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions web-app.org WebAPP versions prior to 0.9.9.7

Description The issue affects various capabilities in web-app.org WebAPP, including login, admin profile edit, reminder, edit profile, profile view, gallery view, gallery comment, and gallery feedback. These capabilities do not verify the presence of users in memberlist.dat, which may have unknown impact and allows for remote attack vectors.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected capabilities until a patch is available.

Fix

Related Identifiers

CVE-2007-3421

Affected Products

Webapp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-3421 · Security Note
• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Patch
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Note
• http://osvdb.org/45402 · Note