CVEvulnerability

CVE-2005-3435

9.8 CRITICAL Published 2005-11-02 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-11-02
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-522

Description

admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example through another Newsworld vulnerability, and specifying the hash in the pwd argument.

Affected configurations

• archilles newsworld (<= 1.3.0)

Related

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

Referenced by CWE · observed example (5)

  • CWE-287 Improper Authentication weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-301 Reflection Attack in an Authentication Protocol weakness
  • CWE-522 Insufficiently Protected Credentials weakness
  • CWE-836 Use of Password Hash Instead of Password for Authentication weakness

References