PT-2011-3643 · Smartertools · Smarterstats

Published 2011-05-20 · Updated 2017-08-29 · CVE-2011-2155

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0

Description The issue concerns the Login.aspx page in the SmarterTools SmarterStats web server, where the ctl00$MPH$txtPassword password form field is generated without disabling the autocomplete feature. This makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.

Recommendations For SmarterTools SmarterStats version 6.0, consider disabling the autocomplete feature for the ctl00$MPH$txtPassword password form field to prevent attackers from bypassing authentication. As a temporary workaround, restrict access to the Login.aspx page until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-2155

Affected Products

Smarterstats

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-2155 · Security Note
• http://kb.cert.org/vuls/id/240150 · Note
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2155 · Note
• http://kb.cert.org/vuls/id/MORO-8GYQR4 · Note
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67827 · Note