PT-2009-3322 · Plunet · Plunet Businessmanager

Publicado 2009-02-23 · Atualizado 2017-08-17 · CVE-2009-0700

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plunet BusinessManager versions 4.1 and earlier

Description The issue allows remote authenticated users to bypass access restrictions. This can lead to reading sensitive Customer or Order data via a modified Pfad parameter to "pagesUTF8/Sys DirAnzeige.jsp" or listing sensitive Jobs via a direct request to "pagesUTF8/auftrag job.jsp".

Recommendations For Plunet BusinessManager versions 4.1 and earlier, restrict access to the "pagesUTF8/Sys DirAnzeige.jsp" and "pagesUTF8/auftrag job.jsp" pages to minimize the risk of exploitation. Avoid using the modified Pfad parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0700

Produtos afetados

Plunet Businessmanager

Referências · 8

• 🔥 https://exploit-db.com/exploits/32710 · Exploit
• 🔥 http://securityfocus.com/bid/33153 · Exploit
• 🔥 https://exploit-db.com/exploits/32709 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html · Exploit
• 🔥 http://securenetwork.it/ricerca/advisory/download/SN-2008-04.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0700 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47794 · Nota