PT-2013-4844 · Imperva · Imperva Securesphere

Published 2013-06-28 · Updated 2013-07-01 · CVE-2013-4091

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere version 9.0.0.5

Description The issue concerns the SecureSphere Operations Manager (SOM) Management Server, where the login page secsphLogin.jsp lacks an autocomplete attribute for the j password field. This omission makes it easier for remote attackers to gain access, particularly in scenarios involving unattended workstations.

Recommendations For Imperva SecureSphere version 9.0.0.5, consider adding an autocomplete attribute to the j password field on the secsphLogin.jsp login page to prevent attackers from easily obtaining access to the system. As a temporary workaround, ensure that workstations are properly secured and monitored to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-4091

Affected Products

Imperva Securesphere

References · 5

• 🔥 https://exploit-db.com/exploits/25977 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4091 · Security Note
• http://digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt · Note
• http://packetstormsecurity.com/files/121861/Imperva-SecureSphere-Operations-Manager-Command-Execution.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4091 · Note