CVE-2008-6752
adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2 parameters in a Change operation.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 6.35% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- revou/revou
- Source
- cve@mitre.org
References
- http://osvdb.org/51705
- http://secunia.com/advisories/33247Vendor Advisory
- http://www.securityfocus.com/bid/34851
- https://www.exploit-db.com/exploits/7523
- http://osvdb.org/51705
- http://secunia.com/advisories/33247Vendor Advisory
- http://www.securityfocus.com/bid/34851
- https://www.exploit-db.com/exploits/7523
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.