NetSight
IP …
critical9.0

CVE-2005-4458

Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks f…

Impact

Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks for special privileges, which allows users to gain administrator privileges by adding themselves to the SITE_MGR group.

Affected products

VendorProductAffected versions
MetadotMetadot Portal Server
Versions 5.5.2.1, 5.6.4, 5.6.4.1, 5.6.4.2, 5.6.4.3, 5.6.5

References