PT-2013-4438 · Groundwork · Groundwork Monitor Enterprise

Johannes Greil · Publicado 2013-05-08 · Atualizado 2013-05-08 · CVE-2013-3503

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue is related to an XML External Entity (XXE) problem, allowing remote authenticated users to read arbitrary files. This is possible through the Profile Importer feature in monarch.cgi in the MONARCH component, when an XML document containing an external entity declaration is used in conjunction with an entity reference.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider disabling the Profile Importer feature in monarch.cgi until a patch is available to prevent exploitation of the XXE issue. Restrict access to the MONARCH component to minimize the risk of unauthorized file reading.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-3503

Produtos afetados

Groundwork Monitor Enterprise

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3503 · Nota de Segurança
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt · Nota
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Nota
• http://kb.cert.org/vuls/id/345260 · Nota