Lucene search
MitreCVE-2009-1771HistoryMay 22, 2009 - 6:30 p.m.
CVE-2009-1771
2009-05-2218:30:00
CWE-264
mitre
web.nvd.nist.gov
32
cve-2009-1771
flyspeck
cms
updateexistingcontent
authentication
remote attackers
admin accounts
nvd
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
7.2
Confidence
Low
EPSS
0.005
Percentile
77.5%
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
Affected configurations
Node
flyspeckflyspeck_cmsMatch6.8
| Vendor | Product | Version | CPE |
|---|---|---|---|
| flyspeck | flyspeck_cms | 6.8 | cpe:2.3:a:flyspeck:flyspeck_cms:6.8:*:*:*:*:*:*:* |
Related
prion
prion
Authentication flaw
2009-05-22 18:30:00
cvelist
cvelist
CVE-2009-1771
2009-05-22 18:00:00
nvd
nvd
CVE-2009-1771
2009-05-22 18:30:00
exploitdb
exploitdb
Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin
2009-05-18 00:00:00
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
7.2
Confidence
Low
EPSS
0.005
Percentile
77.5%
Related for CVE-2009-1771