MitreCVE-2015-6928CVE-2015-6928
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
87.2%
classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cubecart | cubecart | 5.2.12 | cpe:2.3:a:cubecart:cubecart:5.2.12:*:*:*:*:*:*:* |
| cubecart | cubecart | 5.2.13 | cpe:2.3:a:cubecart:cubecart:5.2.13:*:*:*:*:*:*:* |
| cubecart | cubecart | 5.2.14 | cpe:2.3:a:cubecart:cubecart:5.2.14:*:*:*:*:*:*:* |
| cubecart | cubecart | 5.2.15 | cpe:2.3:a:cubecart:cubecart:5.2.15:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.0 | cpe:2.3:a:cubecart:cubecart:6.0.0:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.1 | cpe:2.3:a:cubecart:cubecart:6.0.1:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.2 | cpe:2.3:a:cubecart:cubecart:6.0.2:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.3 | cpe:2.3:a:cubecart:cubecart:6.0.3:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.4 | cpe:2.3:a:cubecart:cubecart:6.0.4:*:*:*:*:*:*:* |
| cubecart | cubecart | 6.0.5 | cpe:2.3:a:cubecart:cubecart:6.0.5:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
87.2%