CVE-2011-5078 Missing authorization in n/a
Remote authenticated users can bypass admin authentication to manage user accounts and read logs in Sybase M-Business Anywhere.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-5078?
CVE-2011-5078 is a medium-severity missing authorization vulnerability in n/a, published on 8 Feb 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499.
Weakness: CWE-264
Which versions are affected by CVE-2011-5078?
It affects 1 product.
Products include Sybase M-Business Anywhere.
How do I fix CVE-2011-5078?
No fix has been published for CVE-2011-5078 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2011-5078 being exploited?
There is no known exploitation of CVE-2011-5078 in the wild and no public exploit code.
Sources
Also known as GHSA-h3pp-99vq-4j5h.