PT-2007-4897 · Av · Av Arcade

Kw3Rln · Published 2007-07-10 · Updated 2018-10-15 · CVE-2007-3643

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AV Arcade version 2.1b

Description The issue allows remote attackers to gain administrative privileges by setting the ava userid cookie value to 1, enabling them to perform certain administrative actions.

Recommendations For AV Arcade version 2.1b, consider restricting access to the admin/index.php page until a fix is available, and avoid using the ava userid cookie value of 1 to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3643

Affected Products

Av Arcade

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-3643 · Security Note
• http://securityfocus.com/bid/24736/info · Note
• http://osvdb.org/38952 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35234 · Note
• http://securityreason.com/securityalert/2871 · Note
• http://securityfocus.com/archive/1/472666/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3643 · Note