BID:12579

NewsBruiser Comment System Security Restrictions Bypass Vulnerability

Info

NewsBruiser Comment System Security Restrictions Bypass Vulnerability

Bugtraq ID:	12579
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 17 2005 12:00AM
Updated:	Feb 17 2005 12:00AM
Credit:	Discovery is credited to Jarno.
Vulnerable:	NewsBruiser NewsBruiser 2.6 NewsBruiser NewsBruiser 2.5 NewsBruiser NewsBruiser 2.4.1 NewsBruiser NewsBruiser 2.4 NewsBruiser NewsBruiser 2.3 NewsBruiser NewsBruiser 2.2 NewsBruiser NewsBruiser 2.1 NewsBruiser NewsBruiser 2.0

Not Vulnerable:	NewsBruiser NewsBruiser 2.6.1

Discussion

NewsBruiser Comment System Security Restrictions Bypass Vulnerability

NewsBruiser is reported prone to a security restriction bypass vulnerability. A remote attacker may delete or approve comments on a site adversely affecting the availability or integrity of data.

NewsBruiser 2.6.0 and prior versions are affected by this issue.

Exploit / POC

NewsBruiser Comment System Security Restrictions Bypass Vulnerability

An exploit is likely not required.

Solution / Fix

NewsBruiser Comment System Security Restrictions Bypass Vulnerability

Solution:
The vendor has released NewsBruiser 2.6.1 to address this issue.

NewsBruiser NewsBruiser 2.0