PT-2013-4437

CVE-2013-3502

·

Published

2013-05-08

·

Updated

2013-11-03

Description by

CVSS 2.0
6.5
Medium
MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0
Description The issue allows remote authenticated users to execute arbitrary commands and obtain sensitive information by leveraging a JOSSO SSO cookie. This is related to the monarch scan.cgi in the MONARCH component.
Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the monarch scan.cgi until a patch is available. As a temporary workaround, limit the use of JOSSO SSO cookies to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-255
Related identifiers
CVE-2013-3502
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com