Lucene search

MitreCVE-2007-5918

HistoryNov 10, 2007 - 2:46 a.m.

CVE-2007-5918

2007-11-1002:46:00

CWE-352

mitre

web.nvd.nist.gov

csrf

vulnerability

edit.php

ms topsites

php-nuke

uname parameter

authenticated users

modules.php

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.

Affected configurations

Nvd

Node

ms_topsitesms_topsites

VendorProductVersionCPE
ms_topsitesms_topsites*cpe:2.3:a:ms_topsites:ms_topsites:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ms_topsites	ms_topsites	*	cpe:2.3:a:ms_topsites:ms_topsites::::::::

References

0x90.com.ar/Advisory/20071106.txt

www.securityfocus.com/archive/1/483353/100/0/threaded

www.securityfocus.com/bid/26358

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Related for CVE-2007-5918