Description
dotProject before 2.1.2 does not properly restrict access to administrative pages, which allows remote attackers to gain privileges. NOTE: some of these details are obtained from third party information.
References
- http://sourceforge.net/project/shownotes.php?group_id=21656&release_id=616346
- dotproject-adminpage-unauth-access(43019) vdb-entry
- 46143 vdb-entry
- 29679 vdb-entry
- 30470 third-party-advisory