PT-2013-4442 · Groundwork+1 · Groundwork Monitor Enterprise+1

Johannes Greil · Published 2013-05-08 · Updated 2013-05-08 · CVE-2013-3507

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0

Description The issue allows remote authenticated users to obtain sensitive information via a direct request for certain files or contexts, including (1) a configuration file, (2) a database dump, or (3) the Tomcat status context.

Recommendations For GroundWork Monitor Enterprise version 6.7.0, restrict access to sensitive files and contexts, such as configuration files, database dumps, and the Tomcat status context, to prevent unauthorized access. Consider disabling direct requests for these sensitive resources until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-3507

Affected Products

Groundwork Monitor Enterprise

Apache Tomcat

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-3507 · Security Note
• https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls · Note
• http://kb.cert.org/vuls/id/345260 · Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-1_GroundWork_Monitoring_Multiple_high_risk_vulnerabilities_part2_wo_poc_v10.txt · Note