PT-2013-1998 · Novell · Novell Sentinel Log Manager

Piotr Chmylkowski

·

Publicado

2013-03-29

·

Atualizado

2017-10-05

·

CVE-2012-6534

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Novell Sentinel Log Manager versions prior to 1.2.0.3
Description The issue allows remote attackers to create data retention policies by sending a crafted text/x-gwt-rpc request to the "novelllogmanager/datastorageservice.rpc" API endpoint. Additionally, remote authenticated Report Administrators can create data retention policies via a "Save Query As" and then "Save As Retention Policy" action in the search results.
Recommendations For versions prior to 1.2.0.3, update to version 1.2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "novelllogmanager/datastorageservice.rpc" API endpoint and limiting the ability of Report Administrators to create data retention policies via the search results "Save Query As" and "Save As Retention Policy" action.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-6534

Produtos afetados

Novell Sentinel Log Manager