Description

Acunetix determined that it is possible to access an installer of the web application without authentication. Depending on the installer, an attacker can takeover of the server.

Remediation

Restrict access to the installer

References

OWASP Authentication Cheat Sheet

Related Vulnerabilities

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.26)

H2 console publicly accessible

Django Debug Toolbar

WordPress Plugin Salon Booking System Multiple Information Disclosure Vulnerabilities (7.6.2)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2156)

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access Configuration