PT-2017-8990 · Opmantek · Nmis

Matthew Kienow · Publicado 2017-04-10 · Atualizado 2017-04-14 · CVE-2016-6534

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opmantek NMIS versions prior to 4.3.7c Opmantek NMIS versions prior to 8.5.12G in non-default configurations

Description The issue concerns command injection via certain commands in the tools.pl CGI script. The affected commands include man, finger, ping, trace, and nslookup.

Recommendations For versions prior to 4.3.7c, update to version 4.3.7c or later. For versions prior to 8.5.12G in non-default configurations, update to version 8.5.12G or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2016-6534

Produtos afetados

Nmis

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-6534 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6534 · Aviso do Fabricante
• https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2 · Nota