PT-2014-3268 · Burden · Burden

Published 2014-01-26 · Updated 2022-04-06 · CVE-2013-7137

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Burden versions prior to 1.8.1

Description The issue concerns the "remember me" functionality in login.php, allowing remote attackers to bypass authentication and gain privileges. This is achieved by setting the burden user rememberme cookie to 1.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the "remember me" functionality in login.php until a patch is available. Restrict access to the login.php module to minimize the risk of exploitation. Avoid using the burden user rememberme cookie in the affected login functionality until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-7137

Affected Products

Burden

References · 9

• 🔥 https://exploit-db.com/exploits/30916 · Exploit
• 🔥 http://exploit-db.com/exploits/30916 · Exploit
• https://github.com/joshf/Burden/commit/edaa1bb8f73d6f3c8b2e78b67f1b40e02fccd0c1 · Patch
• https://github.com/joshf/Burden/issues/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-7137 · Security Note
• https://github.com/joshf/Burden/releases/tag/1.8.1 · Note
• https://htbridge.com/advisory/HTB23192 · Note
• https://t.me/cvenotify/27029 · Telegram Post
• http://securityfocus.com/archive/1/530703/100/0/threaded · Note