PT-2005-5235 · Ftgate · Ftgate

Publicado 2005-12-29 · Atualizado 2011-03-08 · CVE-2005-4567

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FTGate versions 4.4 (Build 4.4.000 Oct 26 2005)

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved by sending specific parameters to certain endpoints, such as the href parameter to "index.fts", or the param1 parameter to "/domains/index.fts", "/config/licence.fts", or "/config/systemacl.fts".

Recommendations For FTGate version 4.4 (Build 4.4.000 Oct 26 2005), consider restricting access to the mentioned endpoints as a temporary workaround until a patch is available. Avoid using the href and param1 parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-4567

Produtos afetados

Ftgate

Referências · 9

• 🔥 http://securitytracker.com/id?1015399 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1015.html · Exploit
• 🔥 http://securityfocus.com/bid/15972 · Exploit
• http://osvdb.org/22105 · Nota
• http://osvdb.org/22107 · Nota
• http://vupen.com/english/advisories/2005/3010 · Nota
• http://osvdb.org/22106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4567 · Nota de Segurança
• http://osvdb.org/22104 · Nota