WebGUI Asset Deletion Vulnerability - Advisories

WebGUI Asset Deletion Vulnerability

Secunia Advisory:	SA23981
Release Date:	2007-01-29
Last Update:	2007-02-01

Critical:	Moderately critical
Impact:	Manipulation of data
Where:	From remote
Solution Status:	Vendor Patch

Software:	WebGUI 7.x

CVE reference:	CVE-2007-0629 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Lucas Bartholemy has reported a vulnerability in WebGUI, which can be exploited by malicious users to delete assets. The vulnerability is caused due to the "www_purgeList()" method not correctly checking the permissions of a user when deleting an asset. The vulnerability is reported in all 7.x versions prior to 7.3.8. Solution: Update to version 7.3.8. Provided and/or discovered by: The vendor credits Lucas Bartholemy. Changelog: 2007-02-01: Added CVE reference. Original Advisory: http://www.plainblack.com/getwebgui/a...ity-defect-discovered-in-7.x-versions http://sourceforge.net/project/shownotes.php?release_id=481584



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

7 Related Secunia Security Advisories

1. WebGUI Collaboration RSS Feed Information Disclosure

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Mozilla Firefox Multiple Vulnerabilities

2.	Opera for Windows Unspecified Code Execution

3.	Mozilla Thunderbird Multiple Vulnerabilities

4.	GNOME Glib PCRE pcre_compile.c Buffer Overflow Vulnerability

5.	Fedora update for glib2

6.	VLC Media Player WAV Processing Integer Overflow

7.	Novell eDirectory ds.dlm Module Buffer Overflow

8.	PCRE pcre_compile.c Buffer Overflow Vulnerability

9.	UnixWare ReliantHA Privilege Escalation Vulnerabilities

10.	Drupal Organic groups Information Disclosure and Script Insertion