PT-2012-5510 · Websense · Websense Web Security

Publicado 2012-08-23 · Atualizado 2012-08-23 · CVE-2012-4604

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Web Security versions prior to 7.6 Hotfix 24

Description The issue allows remote attackers to bypass authentication and read arbitrary reports by crafting specific fields in a cookie, including the uid field and the userRoles field, as demonstrated by a request to "explorer wse/favorites.exe".

Recommendations For Websense Web Security versions prior to 7.6 Hotfix 24, apply Hotfix 24 to resolve the issue.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-4604

Produtos afetados

Websense Web Security

Referências · 2

• 🔥 http://securityfocus.com/archive/1/522530 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4604 · Nota de Segurança