CVE-2006-3584

Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/20889	Vendor Advisory
http://secunia.com/secunia_research/2006-57/advisory/	Vendor Advisory
http://securityreason.com/securityalert/1339
http://www.securityfocus.com/archive/1/441980/100/0/threaded
http://www.securityfocus.com/bid/19303

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jetbox:jetbox_cms:2.1:::::::*
	cpe:2.3:a:jetbox:jetbox_cms:2.1_sr1:::::::*

History

No history.

Information

Published : 2006-08-08 23:04

Updated : 2018-10-18 16:48

NVD link : CVE-2006-3584

Mitre link : CVE-2006-3584

CVE.ORG link : CVE-2006-3584

JSON object : View

Products Affected

jetbox

jetbox_cms

CWE

NVD-CWE-Other

{"id": "CVE-2006-3584", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-08-08T23:04:00.000", "references": [{"url": "http://secunia.com/advisories/20889", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/secunia_research/2006-57/advisory/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://securityreason.com/securityalert/1339", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.securityfocus.com/archive/1/441980/100/0/threaded", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.securityfocus.com/bid/19303", "source": "PSIRT-CNA@flexerasoftware.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables."}, {"lang": "es", "value": "Vulnerabilidad de evaluaci\u00f3n de variable din\u00e1mica en index.php en Jetbox CMS2.1 SR1 permite a atacantes remotos sobrescribir variables de configuraci\u00f3n mediante par\u00e1metros URL, los cuales son evaluados como variables PHP din\u00e1micas."}], "lastModified": "2018-10-18T16:48:05.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbox:jetbox_cms:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0916DF3D-71ED-423F-A2F4-842EE706ADDC"}, {"criteria": "cpe:2.3:a:jetbox:jetbox_cms:2.1_sr1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9CEE445-FE0A-4186-9AD1-3893BCC75EB5"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"}