CVE-2010-0534

Wiki Server in Apple Mac OS X 10.6 before 10.6.3 does not enforce the service access control list (SACL) for weblogs during weblog creation, which allows remote authenticated users to publish content via HTTP requests.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	Vendor Advisory
http://support.apple.com/kb/HT4077	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:mac_os_x:10.6.0:::::::*
	cpe:2.3:o:apple:mac_os_x:10.6.1:::::::*
	cpe:2.3:o:apple:mac_os_x:10.6.2:::::::*
	cpe:2.3:o:apple:mac_os_x_server:10.6.0:::::::*
	cpe:2.3:o:apple:mac_os_x_server:10.6.1:::::::*
	cpe:2.3:o:apple:mac_os_x_server:10.6.2:::::::*

History

No history.

Information

Published : 2010-03-30 18:30

Updated : 2024-02-28 11:41

NVD link : CVE-2010-0534

Mitre link : CVE-2010-0534

CVE.ORG link : CVE-2010-0534

JSON object : View

Products Affected

apple

mac_os_x
mac_os_x_server

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-0534", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-03-30T18:30:01.377", "references": [{"url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://support.apple.com/kb/HT4077", "tags": ["Patch", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Wiki Server in Apple Mac OS X 10.6 before 10.6.3 does not enforce the service access control list (SACL) for weblogs during weblog creation, which allows remote authenticated users to publish content via HTTP requests."}, {"lang": "es", "value": "Wiki Server en Apple Mac OS X v10.6 anterior a v10.6.3, no refuerza el acceso a la lista de control (SACL) para weblogs durante la creaci\u00f3n del mismo, lo que permite a usuarios autenticados remotamente publicar contenidos a trav\u00e9s de peticiones HTTP."}], "lastModified": "2010-06-21T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C69DEE9-3FA5-408E-AD27-F5E7043F852A"}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D25D1FD3-C291-492C-83A7-0AFAFAADC98D"}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B565F77-C310-4B83-B098-22F9489C226C"}, {"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26E34E35-CCE9-42BE-9AFF-561D8AA90E25"}, {"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A04FF6EE-D4DA-4D70-B0CE-154292828531"}, {"criteria": "cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9425320F-D119-49EB-9265-3159070DFE93"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}