PT-2013-4844 · Imperva · Imperva Securesphere

Publicado 2013-06-28 · Atualizado 2013-07-01 · CVE-2013-4091

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere version 9.0.0.5

Description The issue concerns the SecureSphere Operations Manager (SOM) Management Server, where the login page secsphLogin.jsp lacks an autocomplete attribute for the j password field. This omission makes it easier for remote attackers to gain access, particularly in scenarios involving unattended workstations.

Recommendations For Imperva SecureSphere version 9.0.0.5, consider adding an autocomplete attribute to the j password field on the secsphLogin.jsp login page to prevent attackers from easily obtaining access to the system. As a temporary workaround, ensure that workstations are properly secured and monitored to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-4091

Produtos afetados

Imperva Securesphere

Referências · 5

• 🔥 https://exploit-db.com/exploits/25977 · Exploit
• http://digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt · Nota
• http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4091 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4091 · Nota de Segurança