Unscored severity · published Dec 31, 2004
CVE-2004-2443
Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared…
–
CVSS
8.8%
EPSS
No
On KEV
Description
Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the logged_on function in application.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.8% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jaws · Jaws
0.2; 0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2443
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2443
Vendor Advisory
http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0226.html
Exploit
http://securitytracker.com/id?1010651
www.osvdb.org
http://www.osvdb.org/7724
www.securityfocus.com
http://www.securityfocus.com/bid/10670
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/16622
More from Jaws
–
CVE-2009-0645
Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a
–
CVE-2006-3292
SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with the "LIKE" keyword in the searchdata…
–
CVE-2005-3955
Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to…
–
CVE-2005-2179
PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via the path parameter
–
CVE-2005-1231
Cross-site scripting (XSS) vulnerability in the NewTerm function in GlossaryModel.php in JAWS 0.4 allows remote attackers to inject arbitrary web script or HTML via the (1) term…