VULNERABILITY INTELLIGENCE
CVE-2008-3033
CVSS score9.3 HIGH
EPSS probability3.01%
CISA KEVNot currently listed
Published2008-07-07
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich request to modifier_tps_rafraich.php.
Weakness classification
- CWE-287: Improper Authentication