PT-2014-3078 · Algo · Algo Risk Application

Publicado 2014-03-06 · Atualizado 2017-08-29 · CVE-2013-6304

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Algo Risk Application (ARA) versions 2.4.0.1 through 4.9.1

Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by providing a crafted pathname for either a configuration or a JAR file, exploiting multiple directory traversal vulnerabilities.

Recommendations For versions 2.4.0.1 through 4.9.1, consider restricting access to sensitive configuration and JAR files to minimize the risk of exploitation until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-6304

Produtos afetados

Algo Risk Application

Referências · 4

• http://securityfocus.com/bid/65929 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21666093 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6304 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88535 · Nota