PT-2011-3643 · Smartertools · Smarterstats

Publicado 2011-05-20 · Atualizado 2017-08-29 · CVE-2011-2155

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0

Description The issue concerns the Login.aspx page in the SmarterTools SmarterStats web server, where the ctl00$MPH$txtPassword password form field is generated without disabling the autocomplete feature. This makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.

Recommendations For SmarterTools SmarterStats version 6.0, consider disabling the autocomplete feature for the ctl00$MPH$txtPassword password form field to prevent attackers from bypassing authentication. As a temporary workaround, restrict access to the Login.aspx page until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-2155

Produtos afetados

Smarterstats

Referências · 7

• http://kb.cert.org/vuls/id/240150 · Nota
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2155 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2155 · Nota de Segurança
• http://kb.cert.org/vuls/id/MORO-8GYQR4 · Nota
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67827 · Nota