PT-2013-4441 · Groundwork · Groundwork Monitor Enterprise

Publicado 2013-05-08 · Atualizado 2013-05-08 · CVE-2013-3506

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue is related to the improper restriction of XML content in the Performance component of GroundWork Monitor Enterprise. This allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes (SSI) functionality.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the vulnerable cgi-bin/performance/perfchart.cgi endpoint until a patch is available. As a temporary workaround, disabling Server Side Includes (SSI) functionality may help minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-3506

Produtos afetados

Groundwork Monitor Enterprise

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3506 · Nota de Segurança
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt · Nota
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Nota
• http://kb.cert.org/vuls/id/345260 · Nota