PT-2012-3038 · Cyberoam · Cyberoam Central Console

Publicado 2012-02-12 · Atualizado 2012-02-25 · CVE-2012-1047

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cyberoam Central Console versions 2.00.2

Description A directory traversal issue exists in the WWWHELP Service, specifically in the js/html/wwhelp.htm file, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the file parameter within an Online help action.

Recommendations For version 2.00.2, consider restricting access to the file parameter in the Online help action to prevent exploitation until a fix is available. As a temporary workaround, disabling the WWWHELP Service may also minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-1047

Produtos afetados

Cyberoam Central Console

Referências · 7

• 🔥 https://exploit-db.com/exploits/18473 · Exploit
• 🔥 http://exploit-db.com/exploits/18473 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-02/0036.html · Exploit
• 🔥 http://securityfocus.com/bid/51901 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1047 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1047 · Nota de Segurança
• http://vulnerability-lab.com/get_content.php?id=405 · Nota