[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 27 Feb 2015 22:25:10 -0500 (EST)
From: cve-assign@...re.org
To: steffen.roesemann1986@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> six for the 1.7.0 fixes
> multiple CSRF discovered by you
Use CVE-2015-2142.
> multiple CSRF discovered by the vendor
Use CVE-2015-2143.
> multiple XSS discovered by you
Use CVE-2015-2144.
> multiple XSS discovered by the vendor
Use CVE-2015-2145.
> multiple SQL injection discovered by you
Use CVE-2015-2146.
> multiple SQL injection discovered by the vendor
Use CVE-2015-2147.
> one for the 1.7.2 fixes
Use CVE-2015-2148.
When these CVEs are published on the cve.mitre.org web site, there may
be further information about which specific attacks are characterized
with CSRF as the only primary vulnerability, and which specific
attacks are characterized otherwise (e.g., a primary vulnerability of
XSS).
> System Admin ... this account has no more rights than any other
> administrator-account created afterwards
> I think any person with access to an administrative account could
> enter the XSS intentionally, for example to compromise other
> admin-accounts.
The ability of one admin account to enter XSS intentionally, in order
to compromise another equivalent admin account, does not inherently
cross privilege boundaries and is not inherently eligible for a CVE
ID. However, if the vendor specifically announces that a
"vulnerability" fix has been made for such an issue, MITRE typically
defers to the vendor's judgment that the issue is actually a violation
of the product's security policy, and therefore is within the scope of
CVE. The existence of a vendor commit with a fix, however, does not
(by itself) establish a security policy.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU8TPmAAoJEKllVAevmvms1r8H/3F0a0Zfp0kV2DW38AhGe2FP
g0ZYNKxweqCcyeSnB9TD3mX8PaMSBwG/+I51LdmQ51ib+epvWJ+s16DD5chBCofD
9yJ9dUb9O/8IyNpMYWXLSlQc7Nqe/XPfdJOQgeN2XKJXUgcdvzaGZqr0gW2qgltn
pgDUuYhqipFZOw7iUJWmUMu8AyViZycq9zSK5BjbjNFNFKsedPZQC/3wGNqdri0v
SfvwzzjOP/zERKpAiV4VINBzuZypdzSxamt2YgKCc5b0TBdzbx39/F4ukFYt3VFQ
6Dj3sbTqyS3ipuRlWrwO8l8Lj42lx/98PV/9L9jM3ewXKBXiZ4DC4OfxFGXJ4y0=
=MB+v
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
