7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.008 Low
EPSS
Percentile
81.6%
NewsDaemon prior to version 0.21b contains a vulnerability allowing remote attackers to gain administrative access to the web site.
NewsDaemon is a PHP-based tool used to allow readers to submit and comments on news items and stories over the web. It also allows for administration of the web site using HTTP. Versions of NewsDaemon prior to 0.21b allows readers of the web site to submit a malicious HTTP request allowing them to gain administrative access to the web site.
Remote intruders can gain administrative access to the web site.
Update to NewsDaemon version 0.21b or later. If you use PHP3, or cannot set register_globals offin PHP4, you must change NewsDaemon (including 0.21b) as described in the original description of this problem by Forrest J. Cavalier III.
987632
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: May 05, 2001
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
See http://sourceforge.net/forum/forum.php?forum_id=60570 for more information.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23987632 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Our thanks to Forrest J. Cavalier III who originally posted this information to BugTraq.
This document was written by Shawn V. Hernan
CVE IDs: | CVE-2001-0234 |
---|---|
Severity Metric: | 3.19 Date Public: |