PT-2012-3038 · Cyberoam · Cyberoam Central Console

Published 2012-02-12 · Updated 2012-02-25 · CVE-2012-1047

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cyberoam Central Console versions 2.00.2

Description A directory traversal issue exists in the WWWHELP Service, specifically in the js/html/wwhelp.htm file, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the file parameter within an Online help action.

Recommendations For version 2.00.2, consider restricting access to the file parameter in the Online help action to prevent exploitation until a fix is available. As a temporary workaround, disabling the WWWHELP Service may also minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-1047

Affected Products

Cyberoam Central Console

References · 7

• 🔥 https://exploit-db.com/exploits/18473 · Exploit
• 🔥 http://exploit-db.com/exploits/18473 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-02/0036.html · Exploit
• 🔥 http://securityfocus.com/bid/51901 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1047 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1047 · Note
• http://vulnerability-lab.com/get_content.php?id=405 · Note