PT-2017-16361 · Apache+1 · Activemq Broker+1

Publicado 2017-02-13 · Atualizado 2021-09-13 · CVE-2017-5168

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hanwha Techwin Smart Security Manager versions 1.5 and prior Hanwha Techwin Smart Security Manager versions 1.4 and prior to 1.31

Description An issue was discovered in the ActiveMQ Broker service. Multiple Path Traversal vulnerabilities exist, allowing an attacker to gain access to arbitrary files on the server by issuing specific HTTP requests. If a user visits a malicious page, these vulnerabilities can allow for remote code execution.

Recommendations For Hanwha Techwin Smart Security Manager versions 1.5 and prior, update to a version later than 1.5 to resolve the issue. For Hanwha Techwin Smart Security Manager versions 1.4 and prior to 1.31, update to a version later than 1.31 to resolve the issue. As a temporary workaround, consider restricting access to the ActiveMQ Broker service until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-5168

Produtos afetados

Activemq Broker

Hanwha Techwin Smart Security Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5168 · Nota de Segurança
• http://securityfocus.com/bid/96147 · Nota
• https://osv.dev/vulnerability/CVE-2017-5168 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01 · Correção