Lucene search
HistoryMay 15, 2009 - 3:30 p.m.
CVE-2009-1637
cve-2009-1637
simple customer 1.3
profile.php
unauthorized access
admin email
password change
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
7.1 High
AI Score
Confidence
Low
0.027 Low
EPSS
Percentile
90.6%
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters.
Affected configurations
Node
simplecustomersimple_customerMatch1.3
| CPE | Name | Operator | Version |
|---|---|---|---|
| simplecustomer:simple_customer | simplecustomer simple customer | eq | 1.3 |
Related
cvelist
cvelist
CVE-2009-1637
2009-05-15 15:00:00
nvd
nvd
CVE-2009-1637
2009-05-15 15:30:00
prion
prion
Authentication flaw
2009-05-15 15:30:00
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
7.1 High
AI Score
Confidence
Low
0.027 Low
EPSS
Percentile
90.6%
Related for CVE-2009-1637