PT-2001-2010 · Leoboard · Leoboard Lb5000

Publicado 2001-11-22 · Atualizado 2016-10-18 · CVE-2001-0842

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Leoboard LB5000 and LB5000II versions 1029 and earlier

Description A directory traversal issue exists in the Search.cgi component, allowing remote attackers to overwrite files and gain privileges. This is achieved by using .. (dot dot) sequences in the amembernamecookie cookie.

Recommendations For versions 1029 and earlier, consider restricting access to the Search.cgi component until a fix is available. As a temporary workaround, avoid using the amembernamecookie cookie in the Search.cgi endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2001-0842

Produtos afetados

Leoboard Lb5000

Referências · 4

• http://marc.info/?l=bugtraq&m=100446455809273&w=2 · Nota
• http://iss.net/security_center/static/7436.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0842 · Nota de Segurança
• http://securityfocus.com/bid/3484 · Nota