CVE-2005-0685
Multiple access validation errors in OutStart Participate Enterprise (PE) allow remote attackers to (1) browse arbitrary directory trees by…
Published 21 y ago · modified 4 mo ago · JSON
Summary
Multiple access validation errors in OutStart Participate Enterprise (PE) allow remote attackers to (1) browse arbitrary directory trees by modifying the rootFolder parameter to displaynavigator.jsp, (2) rename arbitrary directory objects by modifying the selectedObject parameter to renamepopup.jsp, (3) delete arbitrary directory objects by modifying the selectedObjectsCSV parameter to displaydeletenavigator.jsp, and conduct other unauthorized activities via the (4) showDeleteView, (5) showWebFolderView, (6) showLibraryView, (7) showMyLibraryView, (8) singleSelectObject, (9) processRadioSelection, (10) processCheckboxSelection, (11) singleSelectObject, (12) addToSelectedObjects, or (13) removeFromSelectedObjects commands.
Exploit prediction (EPSS)
1.55% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- secunia.com /advisories/14542 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- securityfocus.com /archive/1/392623 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/19632 · vdb-entry, x_refsource_XF, x_transferred
- security.honour.ca /outstartpsi.txt · x_refsource_MISC, x_transferred
- securityfocus.com /bid/12752 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2005-0685
- NVD: CVE-2005-0685
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.