Auth bypass in Sahanafoundation Sahana

CVE-2010-1191

Sahana disaster management system 0.6.2.2, and possibly other versions, allows remote attackers to bypass intended access restrictions and disable administrator authentication via a direct request to stream.php in an acl_enable_acl action to the admin module.

Vulnerability class: Broken Authentication

EPSS: 0.015 (72.0th percentile) — read the EPSS interpretation.

Affected products

Sahanafoundation Sahana — versions 0.6.2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)