Authentication flaw

2012-08-1221:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.3%

JSON

The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.

CPENameOperatorVersion
ushahidi_platformeq2.1
ushahidi_platformeq2.0
ushahidi_platformeq1.0
ushahidi_platformeq2.2.1
ushahidi_platformle2.4.1
ushahidi_platformeq2.3.1
ushahidi_platformeq2.2
ushahidi_platformeq2.4
ushahidi_platformeq2.3.2
ushahidi_platformeq1.2

Name	Operator	Version
ushahidi_platform	eq	2.1
ushahidi_platform	eq	2.0
ushahidi_platform	eq	1.0
ushahidi_platform	eq	2.2.1
ushahidi_platform	le	2.4.1
ushahidi_platform	eq	2.3.1
ushahidi_platform	eq	2.2
ushahidi_platform	eq	2.4
ushahidi_platform	eq	2.3.2
ushahidi_platform	eq	1.2