Design/Logic Flaw

2008-07-0718:41:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

Low

0.02 Low

EPSS

Percentile

89.0%

JSON

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich request to modifier_tps_rafraich.php.

CPENameOperatorVersion
rss_aggregatoreq1.0

CPE	Name	Operator	Version
	rss_aggregator	eq	1.0

References

securityreason.com/securityalert/3975

www.securityfocus.com/archive/1/493783/100/0/threaded

www.securityfocus.com/bid/30016

exchange.xforce.ibmcloud.com/vulnerabilities/43509