Auth bypass in Livestreet

CVE-2009-3261

update/update_0.1.2_to_0.2.php in LiveStreet 0.2 does not require administrative authentication, which allows remote attackers to perform DROP TABLE operations via unspecified vectors.

Vulnerability class: Broken Authentication

EPSS: 0.014 (70.5th percentile) — read the EPSS interpretation.

Affected products

Livestreet — versions 0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Exploit, x_refsource_MISC)