CVE-2011-2676 The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote auth...
MediumCVSS 5.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ark-web a-form | <= 1.3.5 | No fix listed |
| ark-web a-form | = 2.0.2 | No fix listed |
| ark-web a-form bamboo | = 1.3.5 | No fix listed |
| ark-web a-form bamboo | = 2.0.2 | No fix listed |
| ark-web a-form pc | <= 3.0 | No fix listed |
| ark-web a-form pc mobile | <= 3.0 | No fix listed |
References
- JVN#34980730 third-party-advisory
- JVNDB-2011-000078 third-party-advisory
- www.ark-web.jp patch
- www.ark-web.jp patch
- aformplugin-unspecified-security-bypass(70408) vdb-entry