Webmatic Administration Interface Security Bypass Vulnerability

Bugtraq ID:	24879
Class:	Access Validation Error
CVE:	CVE-2007-3727
Remote:	Yes
Local:	No
Published:	Jul 09 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The vendor reported this issue.
Vulnerable:	Valarsoft WebMatic 2.6.2 Valarsoft WebMatic 2.6.1 Valarsoft WebMatic 2.6
Not Vulnerable:	Valarsoft WebMatic 2.7

Webmatic Administration Interface Security Bypass Vulnerability

Webmatic is prone to a security-bypass vulnerability because the application fails to properly validate user privileges.

An attacker may exploit this issue to access sensitive data regardless of the security settings. This may aid the attacker in further attacks.

Versions prior to Webmatic 2.7 are vulnerable.

Webmatic Administration Interface Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Webmatic Administration Interface Security Bypass Vulnerability

Solution:
The vendor released Webmatic 2.7 to address this issue. Please see the references for more information.


Valarsoft WebMatic 2.6

• Valarsoft Webmatic 2.7
  http://www.valarsoft.com/index.php?dpage=pagine&page=pagine&pagID=12

Valarsoft WebMatic 2.6.1

• Valarsoft Webmatic 2.7
  http://www.valarsoft.com/index.php?dpage=pagine&page=pagine&pagID=12

Valarsoft WebMatic 2.6.2

• Valarsoft Webmatic 2.7
  http://www.valarsoft.com/index.php?dpage=pagine&page=pagine&pagID=12

Webmatic Administration Interface Security Bypass Vulnerability

References:

• Webmatic Website (Webmatic)
  
• Webmatic: Webmatic 2.7 release (Valarsoft)