Lucene search

[email protected]CVE-2008-6736

HistoryApr 21, 2009 - 6:30 p.m.

CVE-2008-6736

2009-04-2118:30:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2008-6736

flat calendar 1.1

administrative functions

remote attackers

security vulnerability

caladd.php

deleteevent.php

access control

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.022 Low

EPSS

Percentile

89.4%

JSON

Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete events via admin/deleteEvent.php. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product’s security documentation.

Affected configurations

NVD

Node

circulargeniusflat_calendarMatch1.1

CPENameOperatorVersion
circulargenius:flat_calendarcirculargenius flat calendareq1.1

CPE	Name	Operator	Version
circulargenius:flat_calendar	circulargenius flat calendar	eq	1.1

References

osvdb.org/51506

www.securityfocus.com/archive/1/493278/100/0/threaded

www.securityfocus.com/bid/29662

exchange.xforce.ibmcloud.com/vulnerabilities/43039

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.022 Low

EPSS

Percentile

89.4%

JSON

Related for CVE-2008-6736

cvelist1 prion1 nvd1