PT-2019-7049 · Vembu · Vembu Storegrid

Gionathan Reale + 1 · Publicado 2019-02-23 · Atualizado 2019-03-18 · CVE-2014-10079

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vembu StoreGrid version 4.4.x

Description The issue concerns the server web interface of Vembu StoreGrid, where the front page leaks the private IP address. This leak occurs due to incorrect processing of an index.php trailing slash, which discloses the private IP address in the ipaddress hidden form value of the HTML source code.

Recommendations For Vembu StoreGrid version 4.4.x, consider modifying the index.php page to correctly process trailing slashes and remove the disclosure of the private IP address in the ipaddress hidden form value. As a temporary workaround, restrict access to the server web interface to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-10079

Produtos afetados

Vembu Storegrid

Referências · 5

• 🔥 https://exploit-db.com/exploits/46549 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2018120091 · Exploit
• https://seclists.org/fulldisclosure/2014/Aug/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-10079 · Nota de Segurança
• https://packetstormsecurity.com/files/127786/Vembu-Backup-Disaster-Recovery-6.1-Follow-Up.html · Nota