PT-2012-4043 · Ar · Awcm

Publicado 2012-11-26 · Atualizado 2017-08-29 · CVE-2012-2437

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ar web content manager (AWCM) version 2.2

Description The issue allows remote attackers to generate arbitrary cookies without requiring authentication. This can be achieved by manipulating the name parameter in conjunction with the content parameter in the cookie gen.php file.

Recommendations For version 2.2, consider restricting access to the cookie gen.php file to require authentication before generating cookies, and validate the name and content parameters to prevent arbitrary cookie generation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-2437

Produtos afetados

Awcm

Referências · 5

• 🔥 https://exploit-db.com/exploits/38015 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.html · Exploit
• http://packetstormsecurity.org/files/117975/AWCM-2.2-Access-Bypass.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2437 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79926 · Nota