Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password.
References
| Link | Resource |
|---|---|
| https://github.com/gnuboard/gnuboard5/commit/11718eb4c02ffdca5393bedc0300a75e4e7b19f2 | Patch |
| https://gratis-herring-da5.notion.site/Gnuboard-Account-Takeover-version-5-5-4-5-5-5-2f69b0a21be642f58d8b7c72feea343a | Patch Third Party Advisory |
| https://sir.kr/g5_pds/6400 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 |
02 Mar 2023, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://sir.kr/g5_pds/6400 - Patch, Vendor Advisory | |
| References | (MISC) https://github.com/gnuboard/gnuboard5/commit/11718eb4c02ffdca5393bedc0300a75e4e7b19f2 - Patch | |
| References | (MISC) https://gratis-herring-da5.notion.site/Gnuboard-Account-Takeover-version-5-5-4-5-5-5-2f69b0a21be642f58d8b7c72feea343a - Patch, Third Party Advisory | |
| CWE | CWE-732 | |
| CPE | cpe:2.3:a:sir:gnuboard:5.5.4:*:*:*:*:*:*:* cpe:2.3:a:sir:gnuboard:5.5.5:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
21 Feb 2023, 14:50
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-20 20:15
Updated : 2024-02-04 23:14
NVD link : CVE-2022-44216
Mitre link : CVE-2022-44216
CVE.ORG link : CVE-2022-44216
JSON object : View
Products Affected
sir
- gnuboard
CWE
CWE-306
Missing Authentication for Critical Function