PT-2001-2036 · Alchemy · Alchemy Network Monitor+1

Published 2001-11-30 · Updated 2017-12-19 · CVE-2001-0870

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Alchemy Eye and Alchemy Network Monitor versions 1.9x through 2.6.18

Description The HTTP server in the affected software is enabled without authentication by default. This allows remote attackers to obtain network monitoring logs, which may contain sensitive information, by directly requesting the eye.ini file.

Recommendations For versions 1.9x through 2.6.18, consider disabling the HTTP server or configuring it to require authentication to prevent unauthorized access to network monitoring logs.

Fix

Related Identifiers

CVE-2001-0870

Affected Products

Alchemy Eye

Alchemy Network Monitor

References · 4

• http://securityfocus.com/bid/3598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0870 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7630 · Note
• http://marc.info/?l=bugtraq&m=100715758109838&w=2 · Note