PT-2008-4684 · Phpscheduleit · Phpscheduleit

Published 2008-07-24 · Updated 2017-08-08 · CVE-2008-3268

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: phpScheduleIt versions 1.2.0 through 1.2.9

Description: The issue allows remote attackers with knowledge of an administrator's email address to bypass restrictions and gain privileges. This is related to login names when the useLogonName feature is enabled.

Recommendations: For phpScheduleIt versions 1.2.0 through 1.2.9, consider disabling the useLogonName feature as a temporary workaround until a patch is available. Restrict access to administrator email addresses to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3268

Affected Products

Phpscheduleit

References · 6

• http://secunia.com/advisories/31147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3268 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=614202 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3268 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43900 · Note
• http://securityfocus.com/bid/30300 · Note