PT-2014-2909 · Openpne · Openpne

Egidio Romano · Published 2014-01-24 · Updated 2014-01-24 · CVE-2013-5350

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenPNE versions 3.6.13 through 3.6.13 OpenPNE versions 3.8.9 through 3.8.9

Description The issue concerns the "Remember me" feature, which does not properly validate login data in HTTP Cookie headers. This allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Recommendations For OpenPNE versions 3.6.13 through 3.6.13, update to version 3.6.13.1 to resolve the issue. For OpenPNE versions 3.8.9 through 3.8.9, update to version 3.8.9.1 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-5350

Affected Products

Openpne

References · 6

• http://secunia.com/advisories/54043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5350 · Security Note
• https://openpne.jp/archives/12293 · Vendor Advisory
• http://secunia.com/secunia_research/2014-1 · Vendor Advisory
• http://jvn.jp/en/jp/JVN69986880/index.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009 · Note