PT-2017-6374 · Netsweeper · Netsweeper

Anastasios Monachos + 1 · Published 2017-09-19 · Updated 2017-09-29 · CVE-2014-9618

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 3.1.10 Netsweeper versions 4.0.x prior to 4.0.9 Netsweeper versions 4.1.x prior to 4.1.2

Description The issue allows remote attackers to bypass authentication and create arbitrary profiles via a showdeny action to the default URL.

Recommendations For versions prior to 3.1.10, update to version 3.1.10 or later. For versions 4.0.x prior to 4.0.9, update to version 4.0.9 or later. For versions 4.1.x prior to 4.1.2, update to version 4.1.2 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-9618

Affected Products

Netsweeper

References · 4

• 🔥 https://exploit-db.com/exploits/37933 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9618 · Security Note
• http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9618 · Note