PT-2009-2183 · Xecms · Xecms

T0Pp8Uzz · Published 2009-04-10 · Updated 2021-03-05 · CVE-2008-6714

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xeCMS versions 1.0.0 RC2 and earlier

Description The issue allows remote attackers to bypass authentication and access the admin panel by setting the xecms username cookie. This enables unauthorized access to the admin panel.

Recommendations For xeCMS versions 1.0.0 RC2 and earlier, as a temporary workaround, consider restricting access to the admin panel until a patch is available. Avoid using the xecms username cookie in the affected admin.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-6714

Affected Products

Xecms

References · 5

• 🔥 http://securityfocus.com/bid/29740 · Exploit
• 🔥 https://exploit-db.com/exploits/5818 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6714 · Security Note
• https://t.me/cvenotify/10935 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43114 · Note