CVE-2010-0215 - ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and (1) delete an attachment or (2) subscribe to an object, via a crafted URL

Back Back to CVE browser

MEDIUM

ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and (1) delete an attachment or (2) subscribe to an object, via a crafted URL

Published Jan 7, 2011

6.0

MEDIUM

CVSS 2.0

EPSS 1.52%

Description

ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and (1) delete an attachment or (2) subscribe to an object, via a crafted URL.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (3)

http://www.activecollab.com/docs/manuals/admin/release-notes/activecollab-2-3-2
x_refsource_CONFIRMVendor Advisory
http://www.kb.cert.org/vuls/id/236703
third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-0246
Advisory

Link	Providers	Tags
http://www.activecollab.com/docs/manuals/admin/release-notes/activecollab-2-3-2		x_refsource_CONFIRMVendor Advisory
http://www.kb.cert.org/vuls/id/236703		third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource
https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-0246		Advisory