PT-2011-3461 · Indusoft · Indusoft Web Studio+1

Published 2011-05-04 · Updated 2011-05-31 · CVE-2011-1900

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio versions 6.1 through 7.0

Description A directory traversal issue in NTWebServer allows remote attackers to execute arbitrary code via an invalid request.

Recommendations For InduSoft Web Studio version 6.1, apply Patch 1 to version 7.0 to resolve the issue. For InduSoft Web Studio versions 7.x before 7.0+Patch 1, apply Patch 1 to version 7.0 to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-1900

Affected Products

Indusoft Web Studio

Ntwebserver

References · 3

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-1900 · Security Note
• http://indusoft.com/hotfixes/hotfixes.php · Note