PT-2017-6637 · Beaker · Beaker

Dan Callaghan · Publicado 2017-09-06 · Atualizado 2020-03-09 · CVE-2015-3163

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 20.1

Description The issue concerns the lack of access controls on the admin pages for power types and key types in Beaker. This allows remote authenticated users to modify these types by navigating to the respective pages, such as $BEAKER/powertypes and $BEAKER/keytypes.

Recommendations For versions prior to 20.1, update to version 20.1 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2015-3163

Produtos afetados

Beaker

Referências · 5

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1215034 · Exploit
• https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3163 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/05/08/1 · Nota
• http://securityfocus.com/bid/74567 · Nota