PT-2005-5235 · Ftgate · Ftgate

Published 2005-12-29 · Updated 2011-03-08 · CVE-2005-4567

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FTGate versions 4.4 (Build 4.4.000 Oct 26 2005)

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved by sending specific parameters to certain endpoints, such as the href parameter to "index.fts", or the param1 parameter to "/domains/index.fts", "/config/licence.fts", or "/config/systemacl.fts".

Recommendations For FTGate version 4.4 (Build 4.4.000 Oct 26 2005), consider restricting access to the mentioned endpoints as a temporary workaround until a patch is available. Avoid using the href and param1 parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-4567

Affected Products

Ftgate

References · 9

• 🔥 http://securitytracker.com/id?1015399 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1015.html · Exploit
• 🔥 http://securityfocus.com/bid/15972 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4567 · Security Note
• http://osvdb.org/22105 · Note
• http://osvdb.org/22107 · Note
• http://vupen.com/english/advisories/2005/3010 · Note
• http://osvdb.org/22106 · Note
• http://osvdb.org/22104 · Note