PT-2010-3755 · Clearsite · Clearsite

Published 2010-06-03 · Updated 2018-10-10 · CVE-2010-2145

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClearSite versions prior to the fixed version, possibly including Beta 4.50

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the cs base path parameter to API endpoints such as "docs.php" and "include/admin/device admin.php". This may be due to a variable extraction error.

Recommendations For ClearSite Beta 4.50 and possibly other affected versions, consider restricting access to the docs.php and include/admin/device admin.php API endpoints until a patch is available. Avoid using the cs base path parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-2145

Affected Products

Clearsite

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-2145 · Security Note
• http://securityfocus.com/bid/40457 · Note
• http://securityfocus.com/archive/1/511507/100/0/threaded · Note