Title: Akopia Interchange Sample Files Vulnerability
Severity: MODERATE
Description:
A vulnerability exists in components of Akopia Interchange e-commerce platform.
Versions of Interchange ship with sample ecommerce 'stores' ("barry", "basic" and "construct").
These sample files contain a group id named "backup" with no associated password, allowing unauthenticated remote users to connect to the demo stores' web-based administration interface.
From this interface it is possible for a malicious user to read or change the customer data, product items and order information.
This is a concern if the sample files are still in place, or if the production stores on the system were based on any of the affected demos.
As a result, an attacker may interfere with an ecommerce website's functionality and compromise the integrity and confidentiality of the site's data.
Affected Products:
- Akopia Interchange 4.5.3
- Akopia Interchange 4.6.3
References:
- Akopia: Akopia Interchange product page
- Jud Harris <jud-lists@copernica.com>: [ic] open login warning (?)
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
