CVEvulnerability

CVE-2005-4458

9.0 HIGH Published 2005-12-21 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-12-21
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks for special privileges, which allows users to gain administrator privileges by adding themselves to the SITE_MGR group.

Affected configurations

• metadot metadot portal server 5.5.2.1 • metadot metadot portal server 5.6.4 • metadot metadot portal server 5.6.4.1 • metadot metadot portal server 5.6.4.2 • metadot metadot portal server 5.6.4.3 • metadot metadot portal server 5.6.5 • metadot metadot portal server 5.6.5.1 • metadot metadot portal server 5.6.5.2 • metadot metadot portal server 5.6.5.3 • metadot metadot portal server 5.6.5.3.1 • metadot metadot portal server 5.6.5.4b5 • metadot metadot portal server 5.6.6 • metadot metadot portal server 6.4 • metadot metadot portal server 6.4.1 • metadot metadot portal server 6.4.2 • metadot metadot portal server 6.4.3 • metadot metadot portal server 6.4.4

References