PT-2008-3171 · Autonomy · Worksite Web

Published 2008-04-08 · Updated 2017-08-08 · CVE-2008-1617

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WorkSite Web versions 8.2 before SP1 P2

Description The issue allows remote attackers to execute arbitrary code via JavaScript. This is achieved by setting the Server property to a string and then setting the string to null, exploiting a double free vulnerability in the Web TransferCtrl Class.

Recommendations For WorkSite Web versions 8.2 before SP1 P2, update to a version that includes SP1 P2 to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript that sets the Server property to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-1617

Affected Products

Worksite Web

References · 6

• 🔥 http://securityfocus.com/bid/28628 · Exploit
• 🔥 http://mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1617 · Security Note
• http://secunia.com/advisories/29733 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1134/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41699 · Note