PT-2010-1639 · Openx · Openx

Published 2010-04-27 · Updated 2010-07-30 · CVE-2009-4830

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenX versions 2.8.1 through 2.8.2

Description The issue allows remote attackers to bypass authentication and obtain access to an Administrator account. This is possibly related to API endpoints such as "www/admin/install.php" and "www/admin/install-plugins.php", as well as other files within the "www/admin/" directory.

Recommendations For versions 2.8.1 and 2.8.2, consider restricting access to the "www/admin/" directory and its files, such as "install.php" and "install-plugins.php", to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-4830

Affected Products

Openx

References · 7

• http://blog.openx.org/12/security-matters-2 · Vendor Advisory
• http://secunia.com/advisories/37914 · Vendor Advisory
• http://forum.openx.org/index.php?showtopic=503454011 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-4830 · Security Note
• http://osvdb.org/61300 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4830 · Note
• http://securityfocus.com/bid/37457 · Note