PT-2008-3171 · Autonomy · Worksite Web

Publicado 2008-04-08 · Atualizado 2017-08-08 · CVE-2008-1617

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WorkSite Web versions 8.2 before SP1 P2

Description The issue allows remote attackers to execute arbitrary code via JavaScript. This is achieved by setting the Server property to a string and then setting the string to null, exploiting a double free vulnerability in the Web TransferCtrl Class.

Recommendations For WorkSite Web versions 8.2 before SP1 P2, update to a version that includes SP1 P2 to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript that sets the Server property to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-1617

Produtos afetados

Worksite Web

Referências · 6

• 🔥 http://securityfocus.com/bid/28628 · Exploit
• 🔥 http://mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1617 · Nota de Segurança
• http://vupen.com/english/advisories/2008/1134/references · Nota
• http://secunia.com/advisories/29733 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41699 · Nota