PT-2006-5332 · Cerberus · Cerberus Helpdesk

Published 2006-09-05 · Updated 2011-03-08 · CVE-2006-4539

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cerberus Helpdesk versions 3.2 Build 317 and possibly earlier

Description The issue allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter in certain widgets.

Recommendations For Cerberus Helpdesk versions 3.2 Build 317 and possibly earlier, consider restricting access to the module company tickets.php and module track tickets.php widgets until a fix is available. Avoid using the ticket parameter in these widgets to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4539

Affected Products

Cerberus Helpdesk

References · 10

• http://secunia.com/advisories/21706 · Vendor Advisory
• http://forum.cerberusweb.com/showthread.php?t=7671 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4539 · Security Note
• http://securitytracker.com/id?1016976 · Note
• http://cerberusweb.com/cvsweb.pl/support-center/cerberus-support-center/includes/widgets/module_company_tickets.php.diff?r1=1.6%3Br2=1.7%3Bf=h · Note
• http://vupen.com/english/advisories/2006/3421 · Note
• http://securityfocus.com/bid/19797 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4539 · Note
• http://osvdb.org/28317 · Note
• http://cerberusweb.com/cvsweb.pl/support-center/cerberus-support-center/includes/widgets/module_track_tickets.php.diff?r1=1.17%3Br2=1.18%3Bf=h · Note