PT-2014-2626 · Microsoft+1 · Internet Explorer+1

Published 2014-01-29 · Updated 2014-02-21 · CVE-2013-2747

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Courion Access Risk Management Suite version 8 Update 9

Description The issue concerns the password reset feature, which allows remote authenticated users to bypass intended Internet Explorer usage restrictions. This can be achieved by utilizing keyboard shortcuts to navigate the file system and open a command prompt, ultimately enabling the execution of arbitrary commands.

Recommendations For Courion Access Risk Management Suite version 8 Update 9, consider restricting access to the password reset feature until a fix is available, and limit the use of keyboard shortcuts within the application to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-2747

Affected Products

Courion Access Risk Management Suite

Internet Explorer

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-2747 · Security Note
• http://blog.securestate.com/courion-authentication-bypass-vulnerability-disclosure-cve-2013-2747 · Note