Description

Acunetix determined that it is possible to access an installer of the web application without authentication. Depending on the installer, an attacker can takeover of the server.

Remediation

Restrict access to the installer

References

OWASP Authentication Cheat Sheet

Related Vulnerabilities

Apache Tomcat version older than 7.0.30

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.16)

WordPress W3 Total Cache plugin predictable cache filenames

WordPress Plugin Video Embed & Thumbnail Generator Information Disclosure (1.1)

Invalid SSL Certificate

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Insecure Admin Access Configuration