CVE-2009-1283
09.04.2009, 16:27
glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.Enginsight
| Vendor | Product | Version |
|---|---|---|
| glfusion | glfusion | 𝑥 ≤ 1.1.2 |
| glfusion | glfusion | 1.0.0 |
| glfusion | glfusion | 1.0.0:rc1 |
| glfusion | glfusion | 1.0.0:rc2 |
| glfusion | glfusion | 1.0.1 |
| glfusion | glfusion | 1.0.2 |
| glfusion | glfusion | 1.1.0 |
| glfusion | glfusion | 1.1.0:rc1 |
| glfusion | glfusion | 1.1.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References