CVE-2002-0108

Allaire Forums 2.0.4 and 2.0.5 and Forums! 3.0 and 3.1 allows remote authenticated users to spoof messages as other users by modifying the hidden form fields for the name and e-mail address.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://online.securityfocus.com/archive/1/249026	Vendor Advisory
http://www.iss.net/security_center/static/7841.php	Vendor Advisory
http://www.kb.cert.org/vuls/id/575619	US Government Resource
http://www.securityfocus.com/bid/3827

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:allaire:forums:2.0.4:::::::*
	cpe:2.3:a:allaire:forums:2.0.5:::::::*
	cpe:2.3:a:allaire:forums:3.0:::::::*
	cpe:2.3:a:allaire:forums:3.1:::::::*

History

No history.

Information

Published : 2002-03-25 05:00

Updated : 2008-11-04 05:23

NVD link : CVE-2002-0108

Mitre link : CVE-2002-0108

CVE.ORG link : CVE-2002-0108

JSON object : View

Products Affected

allaire

forums

CWE

NVD-CWE-Other

{"id": "CVE-2002-0108", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2002-03-25T05:00:00.000", "references": [{"url": "http://online.securityfocus.com/archive/1/249026", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/7841.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/575619", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/3827", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Allaire Forums 2.0.4 and 2.0.5 and Forums! 3.0 and 3.1 allows remote authenticated users to spoof messages as other users by modifying the hidden form fields for the name and e-mail address."}, {"lang": "es", "value": "Allaire Forums 2.0.4 y 2.0.5 y Foros! 3.0 y 3.1 permiten a usuarios remotos autorizados suplantar la identidad de otros usuarios (Spoofing) para enviar mensajes modificando en el formulario los campos de nombre y direcci\u00f3n de correo."}], "lastModified": "2008-11-04T05:23:03.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:allaire:forums:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D746DEF6-40BE-405A-A36F-AD78843CA9AF"}, {"criteria": "cpe:2.3:a:allaire:forums:2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56882CBB-6AE2-4918-80FF-CB22CD57DF54"}, {"criteria": "cpe:2.3:a:allaire:forums:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D5E00AB-BA3B-4D75-BB1E-CD3B66EAD1F2"}, {"criteria": "cpe:2.3:a:allaire:forums:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "843D94C2-78E4-47C8-B7F9-752E434ED95B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}