Lucene search
HistoryJul 06, 2007 - 7:30 p.m.
CVE-2007-3611
vrnews
admin.php
authentication bypass
cve-2007-3611
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
6.8 Medium
AI Score
Confidence
Low
0.036 Low
EPSS
Percentile
91.7%
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a (1) edit, (2) add, (3) config, or (4) del value in the act parameter.
Affected configurations
Node
vrnewsvrnewsMatch1.1.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| vrnews:vrnews | vrnews | eq | 1.1.1 |
Related
prion
prion
Authentication flaw
2007-07-06 19:30:00
nvd
nvd
CVE-2007-3611
2007-07-06 19:30:00
cvelist
cvelist
CVE-2007-3611
2007-07-06 19:00:00
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
6.8 Medium
AI Score
Confidence
Low
0.036 Low
EPSS
Percentile
91.7%
Related for CVE-2007-3611