PT-2010-2314 · Apache+1 · Tomcat Manager+1

Publicado 2010-02-05 · Atualizado 2010-02-08 · CVE-2010-0557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Cognos Express version 9.0

Description The issue allows attackers to obtain unspecified access to the Tomcat Manager component and cause a denial of service by leveraging hardcoded credentials.

Recommendations For IBM Cognos Express version 9.0, update the credentials to prevent hardcoded access, and ensure proper configuration to avoid denial of service attacks.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-0557

Produtos afetados

Ibm Cognos Express

Tomcat Manager

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16317 · Exploit
• http://osvdb.org/62118 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21419179 · Aviso do Fabricante
• http://secunia.com/advisories/38457 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0557 · Nota de Segurança
• http://vupen.com/english/advisories/2010/0297 · Aviso do Fabricante
• http://securityfocus.com/bid/38084 · Nota