CVE-2005-4458: Metadot Portal Server

High severity, CVSS 9.0. EPSS: 1.8% chance of exploitation in the next 30 days.

Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks for special privileges, which allows users to gain administrator privileges by adding themselves to the SITE_MGR group.

Affected products

• Metadot Metadot Portal Server: version 5.5.2.1 only; version 5.6.4 only; version 5.6.4.1 only; version 5.6.4.2 only; version 5.6.4.3 only; version 5.6.5 only; …

Published 2005-12-21. Last modified 2026-06-16.