PT-2013-4435 · Groundwork · Groundwork Monitor Enterprise

Johannes Greil · Published 2013-05-08 · Updated 2013-05-08 · CVE-2013-3500

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue concerns the Foundation webapp admin interface in GroundWork Monitor Enterprise, where it uses the nagios account as the owner of writable files under /usr/local/groundwork. This setup allows attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider changing the ownership of writable files under /usr/local/groundwork to a more restrictive account to prevent unauthorized access. Additionally, restrict access to GroundWork scripts to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3500

Affected Products

Groundwork Monitor Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3500 · Security Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt · Note
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Note
• http://kb.cert.org/vuls/id/345260 · Note