PT-2006-6147 · Cerberus · Cerberus Helpdesk

Published 2006-10-20 · Updated 2017-07-20 · CVE-2006-5428

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cerberus Helpdesk version 3.2.1

Description The issue allows remote attackers to bypass the GUI login and obtain sensitive information, specifically ticket data, by sending a direct request for a display get requesters operation. This is possible because the rpc.php file in Cerberus Helpdesk does not verify a client's privileges for this operation.

Recommendations For Cerberus Helpdesk version 3.2.1, consider restricting access to the rpc.php file or the display get requesters operation until a patch is available. As a temporary workaround, limit the exposure of sensitive information by implementing additional authentication mechanisms for direct requests.

Exploit

Fix

Related Identifiers

CVE-2006-5428

Affected Products

Cerberus Helpdesk

References · 8

• 🔥 https://exploit-db.com/exploits/28826 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5428 · Security Note
• http://secunia.com/advisories/22418 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5428 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29655 · Note
• http://forum.cerberusweb.com/showthread.php?t=7922 · Note
• http://vupen.com/english/advisories/2006/4089 · Note
• http://securityfocus.com/bid/20598 · Note