CVE-2008-6752 Missing authorization in n/a
Remote attackers can change the administrator password without verification, gaining full administrative privileges on the ReVou Micro Blogging platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-6752?
CVE-2008-6752 is a high-severity missing authorization vulnerability in n/a, published on 24 Apr 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2 parameters in a Change operation.
Weakness: CWE-20
Which versions are affected by CVE-2008-6752?
It affects 1 product.
Products include Revou Revou.
How do I fix CVE-2008-6752?
No fix has been published for CVE-2008-6752 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2008-6752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-6752 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-xv6w-88m5-8593.