Lucene search
HistoryAug 07, 2008 - 8:41 p.m.
CVE-2008-3509
cve-2008-3509
lovecms
admin authentication bypass
remote code execution
security vulnerability
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.8 High
AI Score
Confidence
Low
0.081 Low
EPSS
Percentile
94.4%
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors.
Affected configurations
Node
lovecmslovecmsMatch1.6.2
| CPE | Name | Operator | Version |
|---|---|---|---|
| lovecms:lovecms | lovecms | eq | 1.6.2 |
Related
cvelist
cvelist
CVE-2008-3509
2008-08-07 20:00:00
nvd
nvd
CVE-2008-3509
2008-08-07 20:41:00
prion
prion
Design/Logic Flaw
2008-08-07 20:41:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.8 High
AI Score
Confidence
Low
0.081 Low
EPSS
Percentile
94.4%
Related for CVE-2008-3509