PT-2011-3645 · Smartertools · Smarterstats

Published 2011-05-20 · Updated 2017-08-29 · CVE-2011-2157

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.0

Description The issue concerns the generation of web pages containing email addresses by certain components in the SmarterTools SmarterStats web server. Specifically, the Admin/frmEmailReportSettings.aspx and Admin/frmGeneralSettings.aspx components produce pages with default form field values that include email addresses. This allows remote attackers to obtain potentially sensitive information by reading these default values.

Recommendations For SmarterTools SmarterStats version 6.0, consider restricting access to the Admin/frmEmailReportSettings.aspx and Admin/frmGeneralSettings.aspx components to minimize the risk of exploitation. As a temporary workaround, modify the components to not include email addresses in the default values of form fields. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-2157

Affected Products

Smarterstats

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-2157 · Security Note
• http://kb.cert.org/vuls/id/240150 · Note
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2157 · Note
• http://kb.cert.org/vuls/id/MORO-8GYQR4 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67825 · Note