CVE-2015-6928

Published Sep 28, 2015

Last updated 8 years ago

Overview

Description: classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-284

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:5.2.12:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "92715FDD-3B78-4EF6-87C3-6562853630D8"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:5.2.13:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "721E8C21-47B8-4B21-A944-07439BAFED84"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:5.2.14:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED7B3B53-353D-4FE4-BE1A-0358C2BA0465"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:5.2.15:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99FA6A94-6657-4AF1-8651-E09D8FD5CA48"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "54A2767D-0233-4382-89D6-694678FDC0A1"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F3A2549-E556-4405-9F72-0696C6A04B95"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AB6F2DD9-F9AC-4B9C-A3F4-1DD71DF1082C"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6DCA4695-9537-4280-9774-230477B13513"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C0B9CDFD-89B0-46A7-A6A6-ED5D8530C706"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5B10B260-D3B2-4240-B421-A929DFA68124"
          },
          {
            "criteria": "cpe:2.3:a:cubecart:cubecart:6.0.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1EB8E4A2-0C68-4B68-81AD-BD480EF3152E"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References