PT-2014-3139 · Piranha+2 · Piranha+2

Othman Madjoudj · Publicado 2014-02-13 · Atualizado 2014-02-18 · CVE-2013-6492

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Piranha version 0.8.6

Description The issue concerns the Piranha Configuration Tool, which fails to properly restrict access to webpages. This allows remote attackers to bypass authentication and potentially read or modify the LVS configuration by sending an HTTP POST request.

Recommendations For Piranha version 0.8.6, consider restricting access to the Piranha Configuration Tool to minimize the risk of exploitation until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2014_0175

CVE-2013-6492

RHSA-2014:0174

RHSA-2014:0175

RHSA-2014_0174

RHSA-2014_0175

Produtos afetados

Centos

Piranha

Red Hat

Referências · 15

• 🔥 https://exploit-db.com/exploits/39097 · Exploit
• http://rhn.redhat.com/errata/RHSA-2014-0174.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2014-February/032195.html · Nota
• https://rhn.redhat.com/errata/RHSA-2014-0175.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6492 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2014:0174 · Nota
• http://bugs.centos.org/view.php?id=6825 · Nota
• https://lists.centos.org/pipermail/centos-announce/2014-February/069632.html · Nota
• https://lists.centos.org/pipermail/centos-announce/2014-February/057076.html · Nota
• http://rhn.redhat.com/errata/RHSA-2014-0175.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2014-February/082319.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1043040 · Nota
• https://access.redhat.com/errata/RHSA-2014:0175 · Nota
• https://access.redhat.com/security/cve/CVE-2013-6492 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6492 · Nota de Segurança