PT-2012-3573 · Autoform · Autoform Pdm Archive

David Elze · Published 2012-06-13 · Updated 2012-09-29 · CVE-2012-1828

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AutoFORM PDM Archive versions prior to 7.1

Description The issue concerns the lack of authorization requirements for administrative functions, allowing remote authenticated users to perform administrative actions. This can be achieved by leveraging knowledge of a hidden function, such as the password-change function.

Recommendations For versions prior to 7.1, update to version 7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1828

Affected Products

Autoform Pdm Archive

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-1828 · Security Note
• http://kb.cert.org/vuls/id/MAPG-8RQL83 · Note
• http://kb.cert.org/vuls/id/773035 · Note
• http://securityfocus.com/bid/53716 · Note
• http://secunia.com/advisories/49335 · Note