PT-2011-1586 · Microsoft+1 · Internet Explorer+1

Garrett Held · Published 2011-02-07 · Updated 2017-08-17 · CVE-2010-4506

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Passlogix v-GO Self-Service Password Reset (SSPR) and OEM versions prior to 7.0A

Description The issue allows physically proximate attackers to execute arbitrary programs without authentication. This can be achieved by triggering the use of an invalid SSL certificate and utilizing the Internet Explorer interface to navigate through the filesystem via a "Save As" dialog, which is reachable from the "Certificate Export" wizard.

Recommendations For versions prior to 7.0A, update to version 7.0A or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-4506

Affected Products

Internet Explorer

Passlogix V-Go Self-Service Password Reset

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-4506 · Security Note
• http://securityfocus.com/bid/46452 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65439 · Note
• http://securityreason.com/securityalert/8065 · Note
• https://trustwave.com/spiderlabs/advisories/TWSL2010-007.txt · Note