PT-2011-3645 · Smartertools · Smarterstats

Publicado 2011-05-20 · Atualizado 2017-08-29 · CVE-2011-2157

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0

Description The issue concerns the generation of web pages containing email addresses by certain components in the SmarterTools SmarterStats web server. Specifically, the Admin/frmEmailReportSettings.aspx and Admin/frmGeneralSettings.aspx components produce pages with default form field values that include email addresses. This allows remote attackers to obtain potentially sensitive information by reading these default values.

Recommendations For SmarterTools SmarterStats version 6.0, consider restricting access to the Admin/frmEmailReportSettings.aspx and Admin/frmGeneralSettings.aspx components to minimize the risk of exploitation. As a temporary workaround, modify the components to not include email addresses in the default values of form fields. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-2157

Produtos afetados

Smarterstats

Referências · 6

• http://kb.cert.org/vuls/id/240150 · Nota
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2157 · Nota
• http://kb.cert.org/vuls/id/MORO-8GYQR4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2157 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67825 · Nota