PT-2009-2947 · Asp · Asp Project Management

Khashayar Fereidani + 2 · Published 2009-01-27 · Updated 2018-10-11 · CVE-2009-0280

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asp Project Management version 1.0

Description The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the crypt cookie to 1, effectively allowing unauthorized access to administrative functions.

Recommendations For Asp Project Management version 1.0, as a temporary workaround, consider restricting access to administrative functions until a patch is available. Avoid using the crypt cookie or set it to a value other than 1 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0280

Affected Products

Asp Project Management

References · 5

• 🔥 https://exploit-db.com/exploits/7850 · Exploit
• 🔥 http://securityfocus.com/bid/33401 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0280 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48172 · Note
• http://securityfocus.com/archive/1/500292/100/0/threaded · Note