PT-2001-2635 · Centra · Centraone+1

Publicado 2001-12-31 · Atualizado 2017-07-11 · CVE-2001-1550

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CentraOne version 5.2 Centra ASP (affected versions not specified)

Description The issue allows local users to obtain cleartext passwords from decoded log files and impersonate users due to the creation of world-writable base64 encoded log files when basic authentication is enabled.

Recommendations For CentraOne version 5.2, consider disabling basic authentication to prevent the creation of world-writable log files. For Centra ASP, restrict access to the log files to minimize the risk of exploitation until a more specific fix is provided. As a temporary workaround, consider implementing additional access controls to the log files to prevent unauthorized access.

Correção

Identificadores relacionados

CVE-2001-1550

Produtos afetados

Centra Asp

Centraone

Referências · 5

• http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0072.html · Aviso do Fabricante
• http://archives.neohapsis.com/archives/ntbugtraq/2001-q4/0205.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7820 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1550 · Nota de Segurança
• http://securityfocus.com/bid/3704 · Nota