Описание
details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest.
Ссылки
- Vendor Advisory
- Patch
- Vendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1Версия до 1.3.2 (включая)Версия до 1.4.1 (включая)Версия до 1.4.2 (включая)Версия до 1.4.3 (включая)Версия до 1.4.4 (включая)
Одно из
cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*
cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*
cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*
cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*
cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*
EPSS
Процентиль: 64%
0.00469
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-264
Связанные уязвимости
github
почти 4 года назад
details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest.
EPSS
Процентиль: 64%
0.00469
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-264