CVE-2000-0688: High severity CGI Script Center Subscribe Me LITE vulnerability

Published Sep 21, 2000

Updated

Subscribe Me LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for the Account Manager by directly calling the subscribe.pl script with the setpwd parameter.

Affected Software

1 affected component

CGI Script Center Subscribe Me LITE=2.0

Remediation

Patch Available

http://www.securityfocus.com/bid/1607

Event History

Sep 21, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker only needs network access to the affected Subscribe Me LITE installation. The issue can be exploited by directly calling the subscribe.pl script with the setpwd parameter; no authentication is required.

What level of access could an attacker obtain?

A successful attacker can change the administrator password and gain Account Manager privileges. The reported impact includes compromise of confidentiality, integrity, and availability.

Is a fix available?

Yes. A patch is available for this issue.

CVE-2000-0688: High severity CGI Script Center Subscribe Me LITE vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What level of access could an attacker obtain?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What level of access could an attacker obtain?

Is a fix available?