PT-2014-6437 · Adaptive Computing · Adaptive Computing Moab

Publicado 2014-10-08 · Atualizado 2018-10-09 · CVE-2014-5376

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adaptive Computing Moab versions prior to 7.2.9 Adaptive Computing Moab version 8 before 8.0.0

Description The issue allows remote authenticated users to impersonate arbitrary users via the actor field in a message, due to the lack of validation that the requesting user matches the actor in the message when a pre-generated key is used.

Recommendations For Adaptive Computing Moab versions prior to 7.2.9, update to version 7.2.9 or later. For Adaptive Computing Moab version 8 before 8.0.0, update to version 8.0.0 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-5376

Produtos afetados

Adaptive Computing Moab

Referências · 6

• 🔥 http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5376 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96700 · Nota
• http://securityfocus.com/bid/70171 · Nota
• http://adaptivecomputing.com/security-advisory · Aviso do Fabricante
• http://securityfocus.com/archive/1/533577/100/0/threaded · Nota