PT-2009-3322 · Plunet · Plunet Businessmanager

Published 2009-02-23 · Updated 2017-08-17 · CVE-2009-0700

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plunet BusinessManager versions 4.1 and earlier

Description The issue allows remote authenticated users to bypass access restrictions. This can lead to reading sensitive Customer or Order data via a modified Pfad parameter to "pagesUTF8/Sys DirAnzeige.jsp" or listing sensitive Jobs via a direct request to "pagesUTF8/auftrag job.jsp".

Recommendations For Plunet BusinessManager versions 4.1 and earlier, restrict access to the "pagesUTF8/Sys DirAnzeige.jsp" and "pagesUTF8/auftrag job.jsp" pages to minimize the risk of exploitation. Avoid using the modified Pfad parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0700

Affected Products

Plunet Businessmanager

References · 8

• 🔥 https://exploit-db.com/exploits/32710 · Exploit
• 🔥 http://securityfocus.com/bid/33153 · Exploit
• 🔥 https://exploit-db.com/exploits/32709 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html · Exploit
• 🔥 http://securenetwork.it/ricerca/advisory/download/SN-2008-04.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0700 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47794 · Note