CVE-2008-3033 RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demo...
HighCVSS 9.3
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich request to modifier_tps_rafraich.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rss aggregator | = 1.0 | No fix listed |
References
- 3975 third-party-advisory
- 20080630 RSS-aggregator Multiple vulnerabilities mailing-list
- 30016 vdb-entry
- rssaggregator-admin-security-bypass(43509) vdb-entry