PT-2024-10562 · Unknown · Planet-Freo

Published 2024-02-04 · Updated 2024-06-26 · CVE-2015-10129

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions planet-freo up to 20150116

Description A vulnerability was found in the file admin/inc/auth.inc.php, where the manipulation of the auth argument leads to incorrect comparison. The attack can be launched remotely, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch with the name 6ad38c58a45642eb8c7844e2f272ef199f59550d. As a temporary workaround, consider restricting access to the vulnerable file admin/inc/auth.inc.php until the patch is applied. Avoid using the auth argument in the affected functionality until the issue is resolved.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2015-10129

Affected Products

Planet-Freo

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-10129 · Security Note
• https://github.com/samwilson/planet-freo/commit/6ad38c58a45642eb8c7844e2f272ef199f59550d · Patch
• https://vuldb.com/?ctiid.252716 · Note
• https://t.me/cvenotify/69944 · Telegram Post
• https://t.me/cvenotify/84501 · Telegram Post
• https://t.me/cvenotify/71094 · Telegram Post
• https://vuldb.com/?id.252716 · Note