Date: Fri, 27 Feb 2015 22:25:10 -0500 (EST) From: cve-assign@...re.org To: steffen.roesemann1986@...il.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > six for the 1.7.0 fixes > multiple CSRF discovered by you Use CVE-2015-2142. > multiple CSRF discovered by the vendor Use CVE-2015-2143. > multiple XSS discovered by you Use CVE-2015-2144. > multiple XSS discovered by the vendor Use CVE-2015-2145. > multiple SQL injection discovered by you Use CVE-2015-2146. > multiple SQL injection discovered by the vendor Use CVE-2015-2147. > one for the 1.7.2 fixes Use CVE-2015-2148. When these CVEs are published on the cve.mitre.org web site, there may be further information about which specific attacks are characterized with CSRF as the only primary vulnerability, and which specific attacks are characterized otherwise (e.g., a primary vulnerability of XSS). > System Admin ... this account has no more rights than any other > administrator-account created afterwards > I think any person with access to an administrative account could > enter the XSS intentionally, for example to compromise other > admin-accounts. The ability of one admin account to enter XSS intentionally, in order to compromise another equivalent admin account, does not inherently cross privilege boundaries and is not inherently eligible for a CVE ID. However, if the vendor specifically announces that a "vulnerability" fix has been made for such an issue, MITRE typically defers to the vendor's judgment that the issue is actually a violation of the product's security policy, and therefore is within the scope of CVE. The existence of a vendor commit with a fix, however, does not (by itself) establish a security policy. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJU8TPmAAoJEKllVAevmvms1r8H/3F0a0Zfp0kV2DW38AhGe2FP g0ZYNKxweqCcyeSnB9TD3mX8PaMSBwG/+I51LdmQ51ib+epvWJ+s16DD5chBCofD 9yJ9dUb9O/8IyNpMYWXLSlQc7Nqe/XPfdJOQgeN2XKJXUgcdvzaGZqr0gW2qgltn pgDUuYhqipFZOw7iUJWmUMu8AyViZycq9zSK5BjbjNFNFKsedPZQC/3wGNqdri0v SfvwzzjOP/zERKpAiV4VINBzuZypdzSxamt2YgKCc5b0TBdzbx39/F4ukFYt3VFQ 6Dj3sbTqyS3ipuRlWrwO8l8Lj42lx/98PV/9L9jM3ewXKBXiZ4DC4OfxFGXJ4y0= =MB+v -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ