PT-2013-3909 · Ithemes · Backupbuddy

Published 2013-04-02 · Updated 2013-04-02 · CVE-2013-2743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BackupBuddy plugin versions 1.3.4, 2.1.4, 2.2.4, 2.2.25, 2.2.28

Description The issue allows remote attackers to bypass authentication. This is achieved by crafting an integer in the step parameter.

Recommendations For version 1.3.4, update to a version that contains a fix for this issue. For version 2.1.4, update to a version that contains a fix for this issue. For version 2.2.4, update to a version that contains a fix for this issue. For version 2.2.25, update to a version that contains a fix for this issue. For version 2.2.28, update to a version that contains a fix for this issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-2743

Affected Products

Backupbuddy

References · 4

• 🔥 http://packetstormsecurity.com/files/120923 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2743 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2743 · Note