Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 27 Feb 2015 22:25:10 -0500 (EST)
Subject: Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities

Hash: SHA1

> six for the 1.7.0 fixes

> multiple CSRF discovered by you

Use CVE-2015-2142.

> multiple CSRF discovered by the vendor

Use CVE-2015-2143.

> multiple XSS discovered by you

Use CVE-2015-2144.

> multiple XSS discovered by the vendor

Use CVE-2015-2145.

> multiple SQL injection discovered by you

Use CVE-2015-2146.

> multiple SQL injection discovered by the vendor

Use CVE-2015-2147.

> one for the 1.7.2 fixes

Use CVE-2015-2148.

When these CVEs are published on the web site, there may
be further information about which specific attacks are characterized
with CSRF as the only primary vulnerability, and which specific
attacks are characterized otherwise (e.g., a primary vulnerability of

> System Admin ... this account has no more rights than any other
> administrator-account created afterwards

> I think any person with access to an administrative account could
> enter the XSS intentionally, for example to compromise other
> admin-accounts.

The ability of one admin account to enter XSS intentionally, in order
to compromise another equivalent admin account, does not inherently
cross privilege boundaries and is not inherently eligible for a CVE
ID. However, if the vendor specifically announces that a
"vulnerability" fix has been made for such an issue, MITRE typically
defers to the vendor's judgment that the issue is actually a violation
of the product's security policy, and therefore is within the scope of
CVE. The existence of a vendor commit with a fix, however, does not
(by itself) establish a security policy.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.