CVE-2007-4914: Input Validation
Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) classgw2checkout.php, (2) classgwauthorizenet.php, (3) classgwnochex.php, (4) classgwpaypal.php, and (5) classgwsafshop.php in sources/classes/paymentgateways/.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability CVE-2007-4914?
CVE-2007-4914 is an unspecified vulnerability in the subscriptions manager of Invision Power Board versions before 2.3.1 that allows remote authenticated users to manipulate member IDs and privilege levels.
What are the affected versions for CVE-2007-4914?
CVE-2007-4914 affects Invision Power Board versions up to and including 2.3.1 and all earlier versions such as 2.1.5, 2.1.6, 2.2, and 2.2.x.
What is the severity of CVE-2007-4914?
CVE-2007-4914 is classified as a high-severity vulnerability due to its potential to allow unauthorized changes to user privileges.
How do I fix CVE-2007-4914?
To fix CVE-2007-4914, you should upgrade to Invision Power Board version 2.3.2 or later, which addresses this vulnerability.
Who can exploit the CVE-2007-4914 vulnerability?
CVE-2007-4914 can be exploited by remote authenticated users, giving them the ability to change member IDs and reduce privileges of other users.