PT-2004-3454 · Serena · Serena Teamtrack

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2563

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serena TeamTrack version 6.1.1

Description The issue allows remote attackers to obtain sensitive information, such as user names, versions, and database information. It also enables cross-site scripting (XSS) attacks. This can be achieved via a direct request to the tmtrack.dll endpoint with modified LoginPage and Template parameters.

Recommendations For Serena TeamTrack version 6.1.1, consider restricting access to the tmtrack.dll endpoint until a patch is available. As a temporary workaround, avoid using the modified LoginPage and Template parameters in requests to tmtrack.dll to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-2563

Affected Products

Serena Teamtrack

References · 10

• 🔥 http://osvdb.org/8185 · Exploit
• 🔥 http://osvdb.org/8183 · Exploit
• 🔥 http://securiteam.com/windowsntfocus/5SP0O0ADGG.html · Exploit
• 🔥 https://exploit-db.com/exploits/24297 · Exploit
• 🔥 http://osvdb.org/8182 · Exploit
• 🔥 http://securityfocus.com/bid/10770 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2563 · Security Note
• http://secunia.com/advisories/12122 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16771 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16777 · Note