PT-2020-7197 · Ispconfig · Ispconfig

Hakong · Published 2020-01-23 · Updated 2020-01-30 · CVE-2012-2087

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ISPConfig version 3.0.4.3

Description The issue allows the "Add new Webdav user" feature to modify permissions and ownership of files on the entire server from the client interface, potentially leading to unauthorized access and modifications.

Recommendations For ISPConfig version 3.0.4.3, consider restricting access to the "Add new Webdav user" feature until a patch is available to prevent unauthorized modifications to the server's file system.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2012-2087

Affected Products

Ispconfig

References · 5

• 🔥 http://openwall.com/lists/oss-security/2012/04/08/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2087 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74739 · Note
• http://openwall.com/lists/oss-security/2012/04/09/4 · Note
• https://securityfocus.com/bid/52936 · Note