Description

Acunetix determined that it is possible to access an installer of the web application without authentication. Depending on the installer, an attacker can takeover of the server.

Remediation

Restrict access to the installer

References

OWASP Authentication Cheat Sheet

Related Vulnerabilities

Web Cache Poisoning through HTTP/2 pseudo-headers

RethinkDB administrative interface publicly exposed

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.20)

WordPress Plugin Count per Day Information Disclosure (3.2.5)

Zope Web Application Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2023-41050)

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access Configuration