PT-2006-6147 · Cerberus · Cerberus Helpdesk

Publicado 2006-10-20 · Atualizado 2017-07-20 · CVE-2006-5428

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cerberus Helpdesk version 3.2.1

Description The issue allows remote attackers to bypass the GUI login and obtain sensitive information, specifically ticket data, by sending a direct request for a display get requesters operation. This is possible because the rpc.php file in Cerberus Helpdesk does not verify a client's privileges for this operation.

Recommendations For Cerberus Helpdesk version 3.2.1, consider restricting access to the rpc.php file or the display get requesters operation until a patch is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional authentication mechanisms for direct requests.

Exploit

Correção

Identificadores relacionados

CVE-2006-5428

Produtos afetados

Cerberus Helpdesk

Referências · 8

• 🔥 https://exploit-db.com/exploits/28826 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5428 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29655 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5428 · Nota de Segurança
• http://forum.cerberusweb.com/showthread.php?t=7922 · Nota
• http://vupen.com/english/advisories/2006/4089 · Nota
• http://securityfocus.com/bid/20598 · Nota
• http://secunia.com/advisories/22418 · Aviso do Fabricante