PT-2017-7883 · Opsview · Opsview Monitor Pro

Publicado 2017-05-03 · Atualizado 2017-05-17 · CVE-2016-10367

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opsview Monitor Pro versions prior to 5.1.0.162300841 Opsview Monitor Pro versions prior to 5.0.2.27475 Opsview Monitor Pro versions prior to 4.6.4.162391051 Opsview Monitor Pro version 4.5.x without a certain 2016 security patch

Description An unauthenticated Directory Traversal issue can be exploited by issuing a specially crafted HTTP GET request. The attack utilizes a simple URL encoding bypass, using %252f instead of /.

Recommendations For versions prior to 5.1.0.162300841, update to version 5.1.0.162300841 or later. For versions prior to 5.0.2.27475, update to version 5.0.2.27475 or later. For versions prior to 4.6.4.162391051, update to version 4.6.4.162391051 or later. For version 4.5.x, apply the certain 2016 security patch to mitigate the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-10367

Produtos afetados

Opsview Monitor Pro

Referências · 3

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10367 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10367 · Aviso do Fabricante