PT-2013-4442 · Groundwork+1 · Groundwork Monitor Enterprise+1

Johannes Greil · Publicado 2013-05-08 · Atualizado 2013-05-08 · CVE-2013-3507

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue allows remote authenticated users to obtain sensitive information via a direct request for certain files or contexts, including (1) a configuration file, (2) a database dump, or (3) the Tomcat status context.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, restrict access to sensitive files and contexts, such as configuration files, database dumps, and the Tomcat status context, to prevent unauthorized access. Consider disabling direct requests for these sensitive resources until a fix is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-3507

Produtos afetados

Groundwork Monitor Enterprise

Apache Tomcat

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3507 · Nota de Segurança
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Nota
• http://kb.cert.org/vuls/id/345260 · Nota
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt · Nota