PT-2008-3181 · Cern · Cds Invenio

Published 2008-04-02 · Updated 2017-08-08 · CVE-2008-1627

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions CDS Invenio versions 0.92.1 and earlier

Description The issue allows remote authenticated users to delete email notification alerts of arbitrary users by modifying the internal UID.

Recommendations For versions 0.92.1 and earlier, consider restricting access to the email notification alert system to prevent unauthorized deletion of alerts until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1627

Affected Products

Cds Invenio

References · 6

• http://secunia.com/advisories/29521 · Vendor Advisory
• http://cdsware.cern.ch/invenio/news.html · Patch
• http://cdsware.cern.ch/lists/project-cdsware-announce/archive/msg00021.shtml · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1627 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41546 · Note
• http://securityfocus.com/bid/28514 · Note