PT-2011-1586 · Microsoft+1 · Internet Explorer+1

Garrett Held · Publicado 2011-02-07 · Atualizado 2017-08-17 · CVE-2010-4506

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Passlogix v-GO Self-Service Password Reset (SSPR) and OEM versions prior to 7.0A

Description The issue allows physically proximate attackers to execute arbitrary programs without authentication. This can be achieved by triggering the use of an invalid SSL certificate and utilizing the Internet Explorer interface to navigate through the filesystem via a "Save As" dialog, which is reachable from the "Certificate Export" wizard.

Recommendations For versions prior to 7.0A, update to version 7.0A or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-4506

Produtos afetados

Internet Explorer

Passlogix V-Go Self-Service Password Reset

Referências · 5

• http://securityfocus.com/bid/46452 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65439 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4506 · Nota de Segurança
• http://securityreason.com/securityalert/8065 · Nota
• https://trustwave.com/spiderlabs/advisories/TWSL2010-007.txt · Nota