PT-2003-2308 · Aprelium Technologies · Abyss Web Server

Publicado 2003-12-31 · Atualizado 2008-09-05 · CVE-2003-1363

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Aprelium Technologies Abyss Web Server versions 1.1.2 and earlier

Description The issue concerns the remote web management interface of the affected software, which fails to log connection attempts to the web management port (9999). This oversight allows remote attackers to perform brute force attacks on the administration console without being detected.

Recommendations For versions 1.1.2 and earlier, consider implementing logging for connection attempts to the web management port as a temporary workaround until a patch is available. Restrict access to the administration console to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2003-1363

Produtos afetados

Abyss Web Server

Referências · 5

• http://iss.net/security_center/static/11310.php · Nota
• http://archives.neohapsis.com/archives/bugtraq/2003-02/0149.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1363 · Nota de Segurança
• http://securityfocus.com/bid/6842 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1363 · Nota