PT-2004-3454 · Serena · Serena Teamtrack

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2563

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serena TeamTrack version 6.1.1

Description The issue allows remote attackers to obtain sensitive information, such as user names, versions, and database information. It also enables cross-site scripting (XSS) attacks. This can be achieved via a direct request to the tmtrack.dll endpoint with modified LoginPage and Template parameters.

Recommendations For Serena TeamTrack version 6.1.1, consider restricting access to the tmtrack.dll endpoint until a patch is available. As a temporary workaround, avoid using the modified LoginPage and Template parameters in requests to tmtrack.dll to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-2563

Produtos afetados

Serena Teamtrack

Referências · 10

• 🔥 http://osvdb.org/8185 · Exploit
• 🔥 http://osvdb.org/8183 · Exploit
• 🔥 http://securiteam.com/windowsntfocus/5SP0O0ADGG.html · Exploit
• 🔥 https://exploit-db.com/exploits/24297 · Exploit
• 🔥 http://osvdb.org/8182 · Exploit
• 🔥 http://securityfocus.com/bid/10770 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2563 · Nota de Segurança
• http://secunia.com/advisories/12122 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16771 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16777 · Nota