CVE-2007-5441 - Vulnerability Details - OpenCVE

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cmsmadesimple	Cms Made Simple

Configuration 1 [-]

cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/
http://osvdb.org/45481
http://securityreason.com/securityalert/3223
http://www.securityfocus.com/archive/1/481984/100/0/threaded

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-14T18:00:00

Updated: 2024-08-07T15:31:58.337Z

Reserved: 2007-10-14T00:00:00

Link: CVE-2007-5441

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-10-14T18:17:00.000

Modified: 2024-11-21T00:37:54.247

Link: CVE-2007-5441

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-07T00:00:00", "descriptions": [{"lang": "en", "value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"}, {"name": "45481", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/45481"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"}, {"name": "3223", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3223"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5441", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"}, {"name": "45481", "refsource": "OSVDB", "url": "http://osvdb.org/45481"}, {"name": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/", "refsource": "CONFIRM", "url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"}, {"name": "3223", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3223"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:31:58.337Z"}, "title": "CVE Program Container", "references": [{"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"}, {"name": "45481", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/45481"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"}, {"name": "3223", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3223"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5441", "datePublished": "2007-10-14T18:00:00", "dateReserved": "2007-10-14T00:00:00", "dateUpdated": "2024-08-07T15:31:58.337Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."}, {"lang": "es", "value": "CMS Made Simple 1.1.3.1 no comprueba los permisos asignados a los usuarios en algunas situaciones, lo cual permite a usuarios remotos autenticados llevar a cabo algunas acciones administrativas, como se ha demostrado (1) a\u00f1adiendo un usuario mediante una petici\u00f3n directa a admin/adduser.php y (2) leyendo el archivo de registro de administraci\u00f3n mediante una petici\u00f3n \"admin/adminlog.php?page=1\"."}], "id": "CVE-2007-5441", "lastModified": "2024-11-21T00:37:54.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-14T18:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/45481"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3223"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/45481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3223"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}