PT-2012-5721
CVE-2012-5003
·
تاريخ النشر
2012-09-19
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
No Machine NX Web Companion versions 3.x and earlier
Description
The issue arises from the improper verification of update authenticity in nxapplet.jar, allowing user-assisted remote attackers to execute arbitrary code. This can be achieved by crafting specific parameters, such as
SiteUrl or RedirectUrl, to point to a malicious client.zip update file.Recommendations
For No Machine NX Web Companion versions 3.x and earlier, consider restricting access to updates until a proper fix is applied, and avoid using the
SiteUrl and RedirectUrl parameters with untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾