PT-2012-4424 · Cerberus · Cerberus Ftp Server

Redro0Cky · Publicado 2012-10-04 · Atualizado 2013-02-07 · CVE-2012-2999

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 5.0.5.0

Description The issue affects the web interface of the software, where multiple cross-site request forgery (CSRF) vulnerabilities are present. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, such as adding a user account or reconfiguring the state of the FTP service. This can be achieved through requests to specific endpoints, for example, "usermanager/users/modify".

Recommendations For versions prior to 5.0.5.0, update to version 5.0.5.0 or later to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-2999

Produtos afetados

Cerberus Ftp Server

Referências · 4

• http://cerberusftp.com/products/releasenotes.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2999 · Nota de Segurança
• http://kb.cert.org/vuls/id/989684 · Nota
• http://securityfocus.com/bid/55788 · Nota