PT-2010-2460 · Limny · Limny

Luis Santana · Published 2010-02-25 · Updated 2017-08-17 · CVE-2010-0709

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Limny version 2.0

Description The issue allows remote attackers to hijack user or administrator authentication for specific requests. This can be done in two ways: (1) by changing the email address or password via the index.php endpoint, and (2) by creating a new user via the admin/modules/user/new action to limny/index.php.

Recommendations For Limny version 2.0, as a temporary workaround, consider restricting access to the index.php and limny/index.php endpoints to minimize the risk of exploitation. Additionally, restrict the admin/modules/user/new action to authorized administrators only until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-0709

Affected Products

Limny

References · 9

• 🔥 http://exploit-db.com/exploits/11477 · Exploit
• 🔥 http://exploit-db.com/exploits/11478 · Exploit
• 🔥 https://exploit-db.com/exploits/11478 · Exploit
• 🔥 https://exploit-db.com/exploits/11477 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0709 · Security Note
• http://limny.org · Vendor Advisory
• http://secunia.com/advisories/38616 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56318 · Note
• http://osvdb.org/62389 · Note