PT-2004-3385 · Groupmax · Groupmax Desktop For Jichitai+2

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2493

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Groupmax World Wide Web (GmaxWWW) versions 2 and 3 Groupmax Desktop versions 5 and 6 Groupmax Desktop for Jichitai (affected versions not specified)

Description: The issue allows remote authenticated users to read arbitrary .html files via the template name parameter. This could potentially lead to unauthorized access to sensitive information.

Recommendations: For Groupmax World Wide Web (GmaxWWW) versions 2 and 3, restrict access to the template name parameter to minimize the risk of exploitation. For Groupmax Desktop versions 5 and 6, avoid using the template name parameter in affected API endpoints until the issue is resolved. For Groupmax Desktop for Jichitai, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-2493

Produtos afetados

Groupmax Desktop

Groupmax Desktop For Jichitai

Groupmax World Wide Web

Referências · 6

• http://hitachi-support.com/security_e/vuls_e/HS04-007_e/01-e.html · Aviso do Fabricante
• http://securityfocus.com/bid/11773 · Nota
• http://secunia.com/advisories/13321 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18278 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2493 · Nota de Segurança
• http://osvdb.org/12153 · Nota