PT-2011-2330 · Collabnet · Collabnet Scrumworks Basic

David Elze · Publicado 2011-01-24 · Atualizado 2017-08-17 · CVE-2011-0410

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CollabNet ScrumWorks Basic version 1.8.4

Description The issue allows context-dependent attackers to obtain sensitive information. This can be achieved by either sniffing the network for transmissions of Java objects or reading the database, as the software uses cleartext credentials for network communication and the internal database.

Recommendations For CollabNet ScrumWorks Basic version 1.8.4, consider restricting access to the database and network transmissions to minimize the risk of exploitation. As a temporary workaround, restrict the use of cleartext credentials in network communication and the internal database until a more secure method is implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-0410

Produtos afetados

Collabnet Scrumworks Basic

Referências · 6

• http://osvdb.org/70601 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64883 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0410 · Nota de Segurança
• http://secunia.com/advisories/43010 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/547167 · Nota
• http://osvdb.org/70602 · Nota