PT-2010-5294 · Nitrosecurity · Nitroview Esm

S_N · Published 2010-10-27 · Updated 2017-08-17 · CVE-2010-4099

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NitroSecurity NitroView ESM version 8.4.0a

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.pm when ESSPMDebug is enabled.

Recommendations For NitroSecurity NitroView ESM version 8.4.0a, consider disabling the ESSPMDebug feature to prevent exploitation until a patch is available. Restrict access to the ess.pm module to minimize the risk of exploitation. Avoid using shell metacharacters in the Request parameter to the affected endpoint until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-4099

Affected Products

Nitroview Esm

References · 7

• 🔥 http://securityfocus.com/bid/44421 · Exploit
• 🔥 http://exploit-db.com/exploits/15318 · Exploit
• 🔥 https://exploit-db.com/exploits/34932 · Exploit
• 🔥 https://exploit-db.com/exploits/15318 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4099 · Security Note
• http://securitytracker.com/id?1024639 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62768 · Note