Lucene search

[email protected]CVE-2005-4458

HistoryDec 21, 2005 - 11:03 a.m.

CVE-2005-4458

2005-12-2111:03:00

[email protected]

web.nvd.nist.gov

cve-2005-4458

metadot portal server

security vulnerability

privilege escalation

nvd

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.5%

JSON

Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks for special privileges, which allows users to gain administrator privileges by adding themselves to the SITE_MGR group.

Affected configurations

NVD

Node

metadotmetadot_portal_serverMatch5.5.2.1

metadotmetadot_portal_serverMatch5.6.4

metadotmetadot_portal_serverMatch5.6.4.1

metadotmetadot_portal_serverMatch5.6.4.2

metadotmetadot_portal_serverMatch5.6.4.3

metadotmetadot_portal_serverMatch5.6.5

metadotmetadot_portal_serverMatch5.6.5.1

metadotmetadot_portal_serverMatch5.6.5.2

metadotmetadot_portal_serverMatch5.6.5.3

metadotmetadot_portal_serverMatch5.6.5.3.1

metadotmetadot_portal_serverMatch5.6.5.4b5

metadotmetadot_portal_serverMatch5.6.6

metadotmetadot_portal_serverMatch6.4

metadotmetadot_portal_serverMatch6.4.1

metadotmetadot_portal_serverMatch6.4.2

metadotmetadot_portal_serverMatch6.4.3

metadotmetadot_portal_serverMatch6.4.4

CPENameOperatorVersion
metadot:metadot_portal_servermetadot metadot portal servereq5.5.2.1
metadot:metadot_portal_servermetadot metadot portal servereq5.6.4
metadot:metadot_portal_servermetadot metadot portal servereq5.6.4.1
metadot:metadot_portal_servermetadot metadot portal servereq5.6.4.2
metadot:metadot_portal_servermetadot metadot portal servereq5.6.4.3
metadot:metadot_portal_servermetadot metadot portal servereq5.6.5
metadot:metadot_portal_servermetadot metadot portal servereq5.6.5.1
metadot:metadot_portal_servermetadot metadot portal servereq5.6.5.2
metadot:metadot_portal_servermetadot metadot portal servereq5.6.5.3
metadot:metadot_portal_servermetadot metadot portal servereq5.6.5.3.1

CPE	Name	Operator	Version
metadot:metadot_portal_server	metadot metadot portal server	eq	5.5.2.1
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.4
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.4.1
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.4.2
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.4.3
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.5
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.5.1
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.5.2
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.5.3
metadot:metadot_portal_server	metadot metadot portal server	eq	5.6.5.3.1

Rows per page:

1-10 of 171

References

archives.neohapsis.com/archives/fulldisclosure/2005-12/1012.html

secunia.com/advisories/18137

securityreason.com/securityalert/287

www.metadot.com/metadot/index.pl?iid=2632

www.osvdb.org/22014

www.securityfocus.com/archive/1/420002/100/0/threaded

www.securityfocus.com/bid/15975

www.vupen.com/english/advisories/2005/3030

exchange.xforce.ibmcloud.com/vulnerabilities/23847

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.5%

JSON

Related for CVE-2005-4458

cvelist1 nvd1