CVE

Id
35338  
CVE No.
CVE-2008-5221  
Status
Candidate  
Description
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.  
Phase
Assigned (20081125)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
387269 35338 CVE-2008-5221 MILW0RM:7170  View
387270 35338 CVE-2008-5221 URL:http://www.milw0rm.com/exploits/7170  View
387271 35338 CVE-2008-5221 BID:32384  View
387272 35338 CVE-2008-5221 URL:http://www.securityfocus.com/bid/32384  View
387273 35338 CVE-2008-5221 VUPEN:ADV-2008-3219  View
387274 35338 CVE-2008-5221 URL:http://www.vupen.com/english/advisories/2008/3219  View
387275 35338 CVE-2008-5221 SREASON:4631  View
387276 35338 CVE-2008-5221 URL:http://securityreason.com/securityalert/4631  View
387277 35338 CVE-2008-5221 XF:wportfolio-userinfo-security-bypass(46772)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
47028 JVNDB-2008-002338 Xerox DocuShare における複数のクロスサイトスクリプティングの脆弱性 Xerox DocuShare には、複数のクロスサイトスクリプティングの脆弱性が存在します。 CVE-2008-5225 35338 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002338.html  View