CVE-2010-0976 Missing authorization in n/a
Remote attackers can access installation scripts to restart setup, potentially gaining administrative control or executing code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-0976?
CVE-2010-0976 is a high-severity missing authorization vulnerability in n/a, published on 16 Mar 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final installation screen states "Important: you must now delete all files beginning with 'install' from the root directory."
Weakness: CWE-264
Which versions are affected by CVE-2010-0976?
It affects 1 product.
Products include Acidcat Acidcat Cms.
How do I fix CVE-2010-0976?
No fix has been published for CVE-2010-0976 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2010-0976 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0976 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5xwc-wcpm-vxxp.