PT-2006-5332 · Cerberus · Cerberus Helpdesk

Publicado 2006-09-05 · Atualizado 2011-03-08 · CVE-2006-4539

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cerberus Helpdesk versions 3.2 Build 317 and possibly earlier

Description The issue allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter in certain widgets.

Recommendations For Cerberus Helpdesk versions 3.2 Build 317 and possibly earlier, consider restricting access to the module company tickets.php and module track tickets.php widgets until a fix is available. Avoid using the ticket parameter in these widgets to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-4539

Produtos afetados

Cerberus Helpdesk

Referências · 10

• http://securitytracker.com/id?1016976 · Nota
• http://cerberusweb.com/cvsweb.pl/support-center/cerberus-support-center/includes/widgets/module_company_tickets.php.diff?r1=1.6%3Br2=1.7%3Bf=h · Nota
• http://vupen.com/english/advisories/2006/3421 · Nota
• http://securityfocus.com/bid/19797 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4539 · Nota
• http://osvdb.org/28317 · Nota
• http://cerberusweb.com/cvsweb.pl/support-center/cerberus-support-center/includes/widgets/module_track_tickets.php.diff?r1=1.17%3Br2=1.18%3Bf=h · Nota
• http://secunia.com/advisories/21706 · Aviso do Fabricante
• http://forum.cerberusweb.com/showthread.php?t=7671 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-4539 · Nota de Segurança