PT-2017-7884 · Opsview · Opsview Monitor Pro

Publicado 2017-05-03 · Atualizado 2017-05-17 · CVE-2016-10368

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Opsview Monitor Pro versions prior to 5.1.0.162300841 Opsview Monitor Pro versions prior to 5.0.2.27475 Opsview Monitor Pro versions prior to 4.6.4.162391051 Opsview Monitor Pro version 4.5.x without a certain 2016 security patch

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via the "back" parameter to the "/login" URI.

Recommendations For versions prior to 5.1.0.162300841, update to version 5.1.0.162300841 or later. For versions prior to 5.0.2.27475, update to version 5.0.2.27475 or later. For versions prior to 4.6.4.162391051, update to version 4.6.4.162391051 or later. For version 4.5.x, apply the certain 2016 security patch.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2016-10368

Produtos afetados

Opsview Monitor Pro

Referências · 3

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10368 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10368 · Aviso do Fabricante