PT-2014-6307 · Alienvault · Alienvault Ossim

Grimmlin · Publicado 2014-08-01 · Atualizado 2014-08-21 · CVE-2014-5159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.6.0

Description The issue allows remote attackers to execute arbitrary SQL commands via the ws data parameter, potentially leading to remote code execution.

Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ws data parameter to minimize the risk of exploitation.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-5159

ZDI-14-271

Produtos afetados

Alienvault Ossim

Referências · 5

• http://zerodayinitiative.com/advisories/ZDI-14-271 · Nota
• http://forums.alienvault.com/discussion/2559/security-advisory-multiple-vulnerabilities · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-14-271 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-5159 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5159 · Nota