PT-2009-1948 · Parallels · Parallels Virtuozzo

Publicado 2009-03-16 · Atualizado 2018-10-11 · CVE-2008-6478

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Parallels Virtuozzo versions 3.0.0-25.4.swsoft through 4.0.0-365.6.swsoft

Description A cross-site request forgery (CSRF) issue exists in the file manager of the VZPP web interface, allowing remote attackers to create and delete arbitrary files as the administrator. This can be achieved via a link or IMG tag to specific API endpoints, such as "vz/cp/vzdir/infrman/envs/files/" for creating files and modifying system configuration through the path parameter.

Recommendations For versions 3.0.0-25.4.swsoft through 4.0.0-365.6.swsoft, consider disabling access to the file manager in the VZPP web interface until a patch is available. Restrict access to the vz/cp/vzdir/infrman/envs/files/ endpoint to minimize the risk of exploitation. Avoid using the path parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-6478

Produtos afetados

Parallels Virtuozzo

Referências · 8

• 🔥 https://exploit-db.com/exploits/31603 · Exploit
• 🔥 http://securityfocus.com/bid/28589 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6478 · Nota de Segurança
• http://securityfocus.com/archive/1/490409/100/0/threaded · Nota
• http://secunia.com/advisories/29675 · Aviso do Fabricante
• http://px.dynalias.org/files/virtuozzo_overwrite.html.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41640 · Nota
• http://osvdb.org/44395 · Nota