Lucene search

[email protected]CVE-2007-2372

HistoryApr 30, 2007 - 11:19 p.m.

CVE-2007-2372

2007-04-3023:19:00

[email protected]

web.nvd.nist.gov

cve-2007-2372

phpmynewsletter

security vulnerability

remote attack

admin/send_mod.php

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.7%

JSON

admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.

Affected configurations

NVD

Node

gregory_kokanoskyphpmynewsletterRange≤0.8_beta_5

CPENameOperatorVersion
gregory_kokanosky:phpmynewslettergregory kokanosky phpmynewsletterle0.8_beta_5

CPE	Name	Operator	Version
gregory_kokanosky:phpmynewsletter	gregory kokanosky phpmynewsletter	le	0.8_beta_5

References

www.securityfocus.com/bid/23342

www.exploit-db.com/exploits/3671

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.7%

JSON

Related for CVE-2007-2372

cvelist1 prion1 nvd1