PT-2013-4445 · Groundwork · Groundwork Monitor Enterprise

Publicado 2013-05-08 · Atualizado 2013-05-08 · CVE-2013-3510

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The affected API endpoints include "nedi/html/System-Export.php", "nedi/html/Devices-List.php", and the "Noma" component.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, update to a version that includes a fix for the SQL injection vulnerabilities. As a temporary workaround, consider restricting access to the affected endpoints "nedi/html/System-Export.php" and "nedi/html/Devices-List.php", as well as the "Noma" component, to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-3510

Produtos afetados

Groundwork Monitor Enterprise

Referências · 4

• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt · Nota
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3510 · Nota de Segurança
• http://kb.cert.org/vuls/id/345260 · Nota