CVE-2009-4657

The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.17% chance of exploitation in the next 30 days, 81th percentile

Published

2010-03-03

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/9717

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/9717

References

• CVE Record
• NVD entry

Related

• CVE-2009-4656
• CVE-2009-4658
• CVE-2009-4655
• CVE-2009-4659
• CVE-2009-4654
• CVE-2009-4660