PT-2015-7637 · Solarwinds · Solarwinds Log & Event Manager

Matt Molinyawe · Publicado 2015-10-07 · Atualizado 2015-10-16 · CVE-2015-7839

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SolarWinds Log and Event Manager (LEM) (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary commands on managed computers. This is achieved via a request to the "services/messagebroker/nonsecurestreamingamf" endpoint, involving the traceroute functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-7839

ZDI-15-461

Produtos afetados

Solarwinds Log & Event Manager

Referências · 3

• http://zerodayinitiative.com/advisories/ZDI-15-461 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7839 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-15-461 · Nota de Segurança