Authentication flaw

2010-07-1213:27:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.8%

JSON

admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.

CPENameOperatorVersion
totalcalendereq2.4

CPE	Name	Operator	Version
	totalcalender	eq	2.4

References

secunia.com/advisories/34824

www.securityfocus.com/bid/34619

www.exploit-db.com/exploits/8496