PT-2004-3385 · Groupmax · Groupmax Desktop For Jichitai+2

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2493

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Groupmax World Wide Web (GmaxWWW) versions 2 and 3 Groupmax Desktop versions 5 and 6 Groupmax Desktop for Jichitai (affected versions not specified)

Description: The issue allows remote authenticated users to read arbitrary .html files via the template name parameter. This could potentially lead to unauthorized access to sensitive information.

Recommendations: For Groupmax World Wide Web (GmaxWWW) versions 2 and 3, restrict access to the template name parameter to minimize the risk of exploitation. For Groupmax Desktop versions 5 and 6, avoid using the template name parameter in affected API endpoints until the issue is resolved. For Groupmax Desktop for Jichitai, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2493

Affected Products

Groupmax Desktop

Groupmax Desktop For Jichitai

Groupmax World Wide Web

References · 6

• http://hitachi-support.com/security_e/vuls_e/HS04-007_e/01-e.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2493 · Security Note
• http://securityfocus.com/bid/11773 · Note
• http://secunia.com/advisories/13321 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18278 · Note
• http://osvdb.org/12153 · Note