Unscored severity · published Nov 25, 2008
CVE-2008-5221
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows…
–
CVSS
2.5%
EPSS
No
On KEV
Description
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wportfolio · Wportfolio
through 0.3; 0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5221
securityreason.com
http://securityreason.com/securityalert/4631
Exploit
http://www.securityfocus.com/bid/32384
www.vupen.com
http://www.vupen.com/english/advisories/2008/3219
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/46772
www.exploit-db.com
https://www.exploit-db.com/exploits/7170
More from Wportfolio
–
CVE-2008-5220
Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an…