CVE Vulnerabilities

CVE-2008-5967

Improper Authentication

Published: Jan 26, 2009 | Modified: Oct 19, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Phpicalendar Phpicalendar 2.22 2.22
Phpicalendar Phpicalendar 2.21 2.21
Phpicalendar Phpicalendar 2.23 2.23
Phpicalendar Phpicalendar 2.2 2.2
Phpicalendar Phpicalendar 0.9 0.9
Phpicalendar Phpicalendar 2.0.1 2.0.1
Phpicalendar Phpicalendar 2.23 2.23
Phpicalendar Phpicalendar 1.1 1.1
Phpicalendar Phpicalendar 0.8 0.8
Phpicalendar Phpicalendar 2.24 2.24
Phpicalendar Phpicalendar 2.1 2.1
Phpicalendar Phpicalendar * 2.3.4
Phpicalendar Phpicalendar 2.0 2.0
Phpicalendar Phpicalendar 1.0 1.0
Phpicalendar Phpicalendar 2.0c 2.0c
Phpicalendar Phpicalendar 0.7 0.7
Phpicalendar Phpicalendar 0.9.5 0.9.5

Potential Mitigations

References