PT-2015-5145 · Unit4 Polska · Unit4 Polska Teta Web

Lukasz Miedziński · Published 2015-09-16 · Updated 2015-09-17 · CVE-2015-1173

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Unit4 Polska TETA Web (formerly TETA Galactica) version 22.62.3.4

Description The issue concerns improper access restriction to certain modules, specifically the Design Mode and Debug Logger mode modules. This allows remote attackers to gain privileges by utilizing crafted received parameters.

Recommendations For version 22.62.3.4, restrict access to the Design Mode and Debug Logger mode modules to prevent unauthorized privilege escalation. As a temporary workaround, consider disabling the Design Mode and Debug Logger mode modules until a proper fix is implemented.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-1173

Affected Products

Unit4 Polska Teta Web

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-1173 · Security Note
• http://seclists.org/fulldisclosure/2015/Aug/68 · Note
• http://packetstormsecurity.com/files/133147/UNIT4TETA-TETA-WEB-22.62.3.4-Authorization-Bypass.html · Note