Vulnerability Description
The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xoops | Xoops | <= 2.4.0 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/37274Vendor Advisory
- http://www.vupen.com/english/advisories/2009/3256Vendor Advisory
- http://www.xoops.org/modules/newbb/viewtopic.php?post_id=319132
- http://www.xoops.org/modules/news/article.php?storyid=5096Patch
- http://secunia.com/advisories/37274Vendor Advisory
- http://www.vupen.com/english/advisories/2009/3256Vendor Advisory
- http://www.xoops.org/modules/newbb/viewtopic.php?post_id=319132
- http://www.xoops.org/modules/news/article.php?storyid=5096Patch
FAQ
What is CVE-2009-4851?
CVE-2009-4851 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative ...
How severe is CVE-2009-4851?
CVE-2009-4851 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-4851?
Check the references section above for vendor advisories and patch information. Affected products include: Xoops Xoops.