PT-2016-4884 · Netiq · Netiq Sentinel

Rgod · Publicado 2016-07-07 · Atualizado 2016-08-01 · CVE-2016-1605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Sentinel versions 7.4.x through 7.4.1

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the ReportViewServlet servlet. This is achieved via a PREVIEW value for the fileType field.

Recommendations For NetIQ Sentinel versions 7.4.x through 7.4.1, update to version 7.4.2 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-1605

ZDI-16-406

Produtos afetados

Netiq Sentinel

Referências · 5

• https://zerodayinitiative.com/advisories/ZDI-16-406 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1605 · Aviso do Fabricante
• https://netiq.com/support/kb/doc.php?id=7017803 · Nota
• http://zerodayinitiative.com/advisories/ZDI-16-406 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1605 · Nota de Segurança