PT-2010-1653 · Toutvirtual · Toutvirtual Virtualiq Pro

Publicado 2010-05-07 · Atualizado 2018-10-10 · CVE-2009-4845

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ToutVirtual VirtualIQ Pro version 3.2 build 7882

Description The configuration page contains cleartext SSH credentials, allowing remote attackers to obtain sensitive information by reading the username and password fields.

Recommendations For ToutVirtual VirtualIQ Pro version 3.2 build 7882, consider restricting access to the configuration page to minimize the risk of exploitation. As a temporary workaround, avoid using the configuration page until a patch is available that properly secures SSH credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-4845

Produtos afetados

Toutvirtual Virtualiq Pro

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-4845 · Nota de Segurança
• http://securenetwork.it/ricerca/advisory/download/SN-2009-02.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58575 · Nota
• http://securityfocus.com/archive/1/507729/100/0/threaded · Nota