PT-2013-4438 · Groundwork · Groundwork Monitor Enterprise

Johannes Greil · Published 2013-05-08 · Updated 2013-05-08 · CVE-2013-3503

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue is related to an XML External Entity (XXE) problem, allowing remote authenticated users to read arbitrary files. This is possible through the Profile Importer feature in monarch.cgi in the MONARCH component, when an XML document containing an external entity declaration is used in conjunction with an entity reference.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, consider disabling the Profile Importer feature in monarch.cgi until a patch is available to prevent exploitation of the XXE issue. Restrict access to the MONARCH component to minimize the risk of unauthorized file reading.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3503

Affected Products

Groundwork Monitor Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3503 · Security Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt · Note
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Note
• http://kb.cert.org/vuls/id/345260 · Note