The "IP address range limitation" function in OpenPNE 1.6 through 1.8, 2.0 through 2.8, 2.10 through 2.14, and 3.0 through 3.4, when mobile device support is enabled, allows remote attackers to bypass the "simple login" functionality via unknown vectors related to spoofing.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-287,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| tejimaya | openpne | 2.4.8.1 |
| tejimaya | openpne | 2.11.7 |
| tejimaya | openpne | 1.8 |
| tejimaya | openpne | 2.10.11 |
| tejimaya | openpne | 2.12.11 |
| tejimaya | openpne | 2.5.0 |
| tejimaya | openpne | 2.5.6 |
| tejimaya | openpne | 2.11.1 |
| tejimaya | openpne | 2.7.4 |
| tejimaya | openpne | 2.10.4 |
| tejimaya | openpne | 2.5.3 |
| tejimaya | openpne | 2.12.0 |
| tejimaya | openpne | 2.11.3 |
| tejimaya | openpne | 2.13.8 |
| tejimaya | openpne | 2.12.5 |
| tejimaya | openpne | 2.8.0 |
| tejimaya | openpne | 2.10.5 |
| tejimaya | openpne | 2.4.1 |
| tejimaya | openpne | 2.6.6.1 |
| tejimaya | openpne | 2.12.9 |
| tejimaya | openpne | 2.12.14 |
| tejimaya | openpne | 2.4.7 |
| tejimaya | openpne | 2.11.5.1 |
| tejimaya | openpne | 2.12.15 |
| tejimaya | openpne | 2.11.4 |
| tejimaya | openpne | 2.10.8 |
| tejimaya | openpne | 2.12.17 |
| tejimaya | openpne | 2.12.17.1 |
| tejimaya | openpne | 2.5.1 |
| tejimaya | openpne | 2.6.8 |
| tejimaya | openpne | 2.10.3 |
| tejimaya | openpne | 2.6.9 |
| tejimaya | openpne | 2.4.3 |
| tejimaya | openpne | 2.10.13.1 |
| tejimaya | openpne | 2.11.2 |
| tejimaya | openpne | 2.6.4 |
| tejimaya | openpne | 2.10.2 |
| tejimaya | openpne | 2.13.1 |
| tejimaya | openpne | 2.12.10 |
| tejimaya | openpne | 2.7.1 |
| tejimaya | openpne | 2.10.5.1 |
| tejimaya | openpne | 2.4.4 |
| tejimaya | openpne | 2.5.2 |
| tejimaya | openpne | 2.12.18 |
| tejimaya | openpne | 2.12.7 |
| tejimaya | openpne | 2.12.16 |
| tejimaya | openpne | 2.11.3.1 |
| tejimaya | openpne | 2.11.5 |
| tejimaya | openpne | 2.6.2 |
| tejimaya | openpne | 2.10.10 |
| tejimaya | openpne | 2.6.11.1 |
| tejimaya | openpne | 2.12.14.1 |
| tejimaya | openpne | 2.10.12 |
| tejimaya | openpne | 2.6.3 |
| tejimaya | openpne | 2.12.3 |
| tejimaya | openpne | 2.12.13 |
| tejimaya | openpne | 2.3.1 |
| tejimaya | openpne | 2.12.6 |
| tejimaya | openpne | 2.5.8 |
| tejimaya | openpne | 1.6 |
| tejimaya | openpne | 2.13.7 |
| tejimaya | openpne | 2.6.0 |
| tejimaya | openpne | 2.7.0 |
| tejimaya | openpne | 2.14.0 |
| tejimaya | openpne | 2.10.6 |
| tejimaya | openpne | 2.3.0 |
| tejimaya | openpne | 2.10.4.1 |
| tejimaya | openpne | 2.12.8 |
| tejimaya | openpne | 2.10.4.2 |
| tejimaya | openpne | 2.3.3 |
| tejimaya | openpne | 2.7.2 |
| tejimaya | openpne | 2.4.6 |
| tejimaya | openpne | 2.4.5 |
| tejimaya | openpne | 2.12.2 |
| tejimaya | openpne | 2.12.4 |
| tejimaya | openpne | 2.4.8 |
| tejimaya | openpne | 2.4.2 |
| tejimaya | openpne | 2.5.5 |
| tejimaya | openpne | 2.13.0 |
| tejimaya | openpne | 2.10.9 |
| tejimaya | openpne | 2.6.5 |
| tejimaya | openpne | 2.6.6 |
| tejimaya | openpne | 2.5.4 |
| tejimaya | openpne | 2.3.4 |
| tejimaya | openpne | 2.10.0 |
| tejimaya | openpne | 2.6.1 |
| tejimaya | openpne | 2.6.6.2 |
| tejimaya | openpne | 2.12.1 |
| tejimaya | openpne | 2.13.5 |
| tejimaya | openpne | 2.6.10 |
| tejimaya | openpne | 2.4.0 |
| tejimaya | openpne | 2.11.6 |
| tejimaya | openpne | 2.12.12 |
| tejimaya | openpne | 2.10.7 |
| tejimaya | openpne | 2.13.3 |
| tejimaya | openpne | 2.13.6 |
| tejimaya | openpne | 2.7.3 |
| tejimaya | openpne | 2.13.2 |
| tejimaya | openpne | 2.13.4 |
| tejimaya | openpne | 2.10.1 |
| tejimaya | openpne | 2.6.7 |
| tejimaya | openpne | 2.10.13 |
Cross-site scripting (XSS) vulnerability in the management screen in OpenPNE 3.4.x before 3.4.21.1, 3.6.x before 3.6.9.1, and 3.8.x before 3.8.5.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the "mobile version color scheme."
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| tejimaya | openpne | 3.4.4 |
| tejimaya | openpne | 3.4.19 |
| tejimaya | openpne | 3.4.14 |
| tejimaya | openpne | 3.4.1.1 |
| tejimaya | openpne | 3.4.8 |
| tejimaya | openpne | 3.6.4 |
| tejimaya | openpne | 3.4.21 |
| tejimaya | openpne | 3.6.3 |
| tejimaya | openpne | 3.6.6 |
| tejimaya | openpne | 3.8.0 |
| tejimaya | openpne | 3.8.2 |
| tejimaya | openpne | 3.4.13 |
| tejimaya | openpne | 3.4.11 |
| tejimaya | openpne | 3.4 |
| tejimaya | openpne | 3.6.0 |
| tejimaya | openpne | 3.4.6 |
| tejimaya | openpne | 3.4.17 |
| tejimaya | openpne | 3.4.0.1 |
| tejimaya | openpne | 3.4.16 |
| tejimaya | openpne | 3.6.2 |
| tejimaya | openpne | 3.4.6.2 |
| tejimaya | openpne | 3.6.9 |
| tejimaya | openpne | 3.6.5 |
| tejimaya | openpne | 3.4.9 |
| tejimaya | openpne | 3.4.5 |
| tejimaya | openpne | 3.4.11.1 |
| tejimaya | openpne | 3.8.1 |
| tejimaya | openpne | 3.4b |
| tejimaya | openpne | 3.4.2 |
| tejimaya | openpne | 3.4.3 |
| tejimaya | openpne | 3.4.9.1 |
| tejimaya | openpne | 3.4.14.1 |
| tejimaya | openpne | 3.4.12.1 |
| tejimaya | openpne | 3.6.8 |
| tejimaya | openpne | 3.8.5 |
| tejimaya | openpne | 3.4.10 |
| tejimaya | openpne | 3.6.7 |
| tejimaya | openpne | 3.8.3 |
| tejimaya | openpne | 3.4.7 |
| tejimaya | openpne | 3.4.4.1 |
| tejimaya | openpne | 3.6.1 |
| tejimaya | openpne | 3.4.1 |
| tejimaya | openpne | 3.4.15 |
| tejimaya | openpne | 3.4.12 |
| tejimaya | openpne | 3.8.4 |
| tejimaya | openpne | 3.4.6.1 |
| tejimaya | openpne | 3.4.15.1 |
| tejimaya | openpne | 3.4.9.2 |
| tejimaya | openpne | 3.8.6 |
| tejimaya | openpne | 3.4.0 |
| tejimaya | openpne | 3.4.18 |
OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | 3.9 | 5.2 |
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-611,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| tejimaya | openpne | 3.8.7 |
| tejimaya | openpne | 3.6.11 |
| tejimaya | openpne | 3.2.7.6 |
| tejimaya | openpne | 3.4.21.1 |
| tejimaya | openpne | 3.0.8.5 |
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 3.9 | 5.9 |
CVSS 2.0
Severity: HIGH
Problem Type: CWE-611,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| tejimaya | opwebapiplugin | 0.1.0 |
| tejimaya | opwebapiplugin | 0.4.0 |
| tejimaya | opwebapiplugin | 0.5.1 |
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object injection attacks, and execute arbitrary PHP code, via a crafted serialized object.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-20,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| tejimaya | openpne | 3.8.9 |
| tejimaya | openpne | 3.6.13 |