9.8

CVE-2005-3435

admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example through another Newsworld vulnerability, and specifying the hash in the pwd argument.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Archilles ≫ Newsworld Version <= 1.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.33% 0.813
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

http://marc.info/?l=bugtraq&m=113018731120709&w=2
Mailing List
http://secunia.com/advisories/17310/
Vendor Advisory
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/22860
Third Party Advisory
VDB Entry