PT-2012-3173 · Easyvista · Easyvista

Ar1Vr · Published 2012-02-22 · Updated 2012-03-21 · CVE-2012-1256

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EasyVista versions prior to 2010.1.1.89

Description The issue concerns the single sign-on (SSO) implementation, which allows remote attackers to bypass authentication. This can be achieved by modifying the url account parameter in conjunction with a valid login name in the SSPI HEADER parameter to the "index.php" endpoint.

Recommendations For versions prior to 2010.1.1.89, update to version 2010.1.1.89 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint or validating the url account and SSPI HEADER parameters to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-1256

Affected Products

Easyvista

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-1256 · Security Note
• http://secunia.com/advisories/48124 · Note
• http://kb.cert.org/vuls/id/273502 · Note