PT-2012-4044 · Ar · Awcm

Published 2012-11-26 · Updated 2017-08-29 · CVE-2012-2438

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ar web content manager (AWCM) version 2.2

Description The issue allows remote attackers to cause a denial of service due to disk consumption. This can be achieved by submitting a large number of comment records through HTTP requests to specific API endpoints, such as "show video.php" or "topic.php", using the coment parameter.

Recommendations For version 2.2, consider restricting the number of comment records that can be submitted through HTTP requests to prevent disk consumption. As a temporary workaround, restrict access to the "show video.php" and "topic.php" endpoints to minimize the risk of exploitation. Avoid using the coment parameter in these affected endpoints until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-2438

Affected Products

Awcm

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2438 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79927 · Note
• http://packetstormsecurity.org/files/117975/AWCM-2.2-Access-Bypass.html · Note