PT-2015-5145 · Unit4 Polska · Unit4 Polska Teta Web

Lukasz Miedziński · Publicado 2015-09-16 · Atualizado 2015-09-17 · CVE-2015-1173

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Unit4 Polska TETA Web (formerly TETA Galactica) version 22.62.3.4

Description The issue concerns improper access restriction to certain modules, specifically the Design Mode and Debug Logger mode modules. This allows remote attackers to gain privileges by utilizing crafted received parameters.

Recommendations For version 22.62.3.4, restrict access to the Design Mode and Debug Logger mode modules to prevent unauthorized privilege escalation. As a temporary workaround, consider disabling the Design Mode and Debug Logger mode modules until a proper fix is implemented.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-1173

Produtos afetados

Unit4 Polska Teta Web

Referências · 3

• http://seclists.org/fulldisclosure/2015/Aug/68 · Nota
• http://packetstormsecurity.com/files/133147/UNIT4TETA-TETA-WEB-22.62.3.4-Authorization-Bypass.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1173 · Nota de Segurança