Description
Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, including the admin password, via crafted POST requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gosa | 2.5.8-1 | — |
| Debian 13 | gosa | 2.5.8-1 | — |
| Debian 12 | gosa | 2.5.8-1 | — |
References
- ADV-2007-0207 vdb-entry
- 23749 third-party-advisory
- gosa-unspecified-data-manipulation(31516) vdb-entry
- 32821 vdb-entry
- [gosa] 20070115 GOsa 2.5.8 released (security fixes!) mailing-list