PT-2010-4129 · Realpage · Realpage Module Activex Controls

Publicado 2010-10-26 · Atualizado 2010-10-28 · CVE-2010-2584

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RealPage Module ActiveX Controls version 1.0.0.9

Description The issue concerns the Upload method in the RealPage Module Upload ActiveX control, which does not properly restrict certain property values. This allows remote attackers to read arbitrary files by specifying a filename in the SourceFile property and an http URL in the DestURL property.

Recommendations For version 1.0.0.9, consider restricting access to the SourceFile and DestURL properties in the Upload method until a patch is available. As a temporary workaround, avoid using the SourceFile property with http URLs in the DestURL property to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2584

Produtos afetados

Realpage Module Activex Controls

Referências · 5

• http://securityfocus.com/bid/44302 · Nota
• http://secunia.com/secunia_research/2010-118 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2584 · Nota de Segurança
• http://osvdb.org/68813 · Nota
• http://secunia.com/advisories/41392 · Aviso do Fabricante