Strix
26.1K

CVE-2009-4851

UnknownEPSS 1.21%

Last modified

CVE-2009-4851 is a vulnerability of currently unknown severity. The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.. EPSS estimates a 1.21% chance of exploitation in the next 30 days.

Description

The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

Metrics

EPSS Probability
1.21%

64.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
XoopsXoops<= 2.4.0
XoopsXoops1.0
XoopsXoops1.0_rc1
XoopsXoops1.0_rc3
XoopsXoops1.0_rc3.0.5
XoopsXoops1.3.5
XoopsXoops1.3.6
XoopsXoops1.3.7
XoopsXoops1.3.8
XoopsXoops1.3.9
XoopsXoops1.3.10
XoopsXoops2.0.0
XoopsXoops2.0.0_rc1
XoopsXoops2.0.0_rc2
XoopsXoops2.0.0_rc3
XoopsXoops2.0.1
XoopsXoops2.0.2
XoopsXoops2.0.3
XoopsXoops2.0.4
XoopsXoops2.0.5.1
XoopsXoops2.0.5.2
XoopsXoops2.0.5_rc
XoopsXoops2.0.6
XoopsXoops2.0.7
XoopsXoops2.0.7.1
XoopsXoops2.0.7.2
XoopsXoops2.0.7.3
XoopsXoops2.0.9
XoopsXoops2.0.9.2
XoopsXoops2.0.9.3
XoopsXoops2.0.10
XoopsXoops2.0.10_rc
XoopsXoops2.0.11
XoopsXoops2.0.12
XoopsXoops2.0.12a
XoopsXoops2.0.13
XoopsXoops2.0.13.1
XoopsXoops2.0.13.2
XoopsXoops2.0.14
XoopsXoops2.0.14-rc1
XoopsXoops2.0.15
XoopsXoops2.0.16
XoopsXoops2.0.17
XoopsXoops2.0.17.1
XoopsXoops2.0.18
XoopsXoops2.0.18.1
XoopsXoops2.3.0
XoopsXoops2.3.0_alpha_3
XoopsXoops2.3.0_alpha1
XoopsXoops2.3.0_alpha2

Showing 50 of 62 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-4851?
The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
How severe is CVE-2009-4851?
Severity scoring for CVE-2009-4851 is pending analysis. The EPSS model estimates a 1.21% probability of exploitation in the next 30 days.
How do I fix CVE-2009-4851?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-4851?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST