PT-2013-4437

CVE-2013-3502

·

Publicado

2013-05-08

·

Atualizado

2013-11-03

Descrição por

CVSS 2.0
6.5
Média
MétricasAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0
Description The issue allows remote authenticated users to execute arbitrary commands and obtain sensitive information by leveraging a JOSSO SSO cookie. This is related to the monarch scan.cgi in the MONARCH component.
Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the monarch scan.cgi until a patch is available. As a temporary workaround, limit the use of JOSSO SSO cookies to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-255
Identificadores relacionados
CVE-2013-3502
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com