CVE-2009-5076
Publicada em · Atualizada em
25Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck.
ssvc Attendepss 1.4%
da publicação à arma
Publicada no NVD8 de jun.
VulnCheck8 de jun.
probabilidade de exploração
1.4%top 28% das CVEs
exploração observada
simVulnCheck
CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.
Produtos afetados
n/a · n/a