PT-2009-6394 · Joomla · Kide Shoutbox
Published
2009-12-08
·
Updated
2009-12-09
·
CVE-2009-4232
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
The Kide Shoutbox (com kide) component version 0.4.6 for Joomla!
Description
The issue is related to improper authentication, allowing remote attackers to post messages with an arbitrary account name. This can be achieved by sending an insertar action to the "index.php" endpoint.
Recommendations
For version 0.4.6, consider restricting access to the insertar action in the index.php endpoint until a proper fix is available. As a temporary workaround, review and monitor all posted messages to prevent unauthorized content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kide Shoutbox