PT-2007-6205 · Flatnuke · Flatnuke

Published 2007-09-26 · Updated 2018-10-15 · CVE-2007-5109

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatNuke versions 2.6 through 3

Description A cross-site request forgery (CSRF) issue allows remote attackers to change the password and privilege level of arbitrary accounts. This is achieved via the user parameter and modified regpass and level parameters in a none Login action.

Recommendations For FlatNuke versions 2.6 through 3, as a temporary workaround, consider restricting access to the none Login action in index.php to minimize the risk of exploitation. Avoid using the regpass and level parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-5109

Affected Products

Flatnuke

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2007-5109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5109 · Security Note
• https://ubuntu.com/security/CVE-2007-5109 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2007-5109 · Security Note
• http://securityfocus.com/bid/25817 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36763 · Note
• http://securityfocus.com/archive/1/480468/100/0/threaded · Note
• http://securityreason.com/securityalert/3176 · Note
• http://secunia.com/advisories/26957 · Note