PT-2010-5294 · Nitrosecurity · Nitroview Esm

S_N · Publicado 2010-10-27 · Atualizado 2017-08-17 · CVE-2010-4099

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NitroSecurity NitroView ESM version 8.4.0a

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.pm when ESSPMDebug is enabled.

Recommendations For NitroSecurity NitroView ESM version 8.4.0a, consider disabling the ESSPMDebug feature to prevent exploitation until a patch is available. Restrict access to the ess.pm module to minimize the risk of exploitation. Avoid using shell metacharacters in the Request parameter to the affected endpoint until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-4099

Produtos afetados

Nitroview Esm

Referências · 7

• 🔥 http://securityfocus.com/bid/44421 · Exploit
• 🔥 http://exploit-db.com/exploits/15318 · Exploit
• 🔥 https://exploit-db.com/exploits/34932 · Exploit
• 🔥 https://exploit-db.com/exploits/15318 · Exploit
• http://securitytracker.com/id?1024639 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62768 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4099 · Nota de Segurança