PT-2007-6599 · Base · Basic Analysis/Security Engine

Published 2007-10-18 · Updated 2017-07-29 · CVE-2007-5578

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine (BASE) versions prior to 1.3.8

Description The issue allows remote attackers to bypass authentication. This can be achieved via several vectors, including the "base main.php" and "base qry alert.php" API endpoints.

Recommendations For versions prior to 1.3.8, update to version 1.3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "base main.php" and "base qry alert.php" endpoints until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-5578

Affected Products

Basic Analysis/Security Engine

References · 9

• http://secunia.com/advisories/25518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5578 · Security Note
• http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34724 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html · Note
• http://securityfocus.com/bid/24315 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5578 · Note
• http://osvdb.org/35243 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html · Note