PT-2017-7883 · Opsview · Opsview Monitor Pro

Published 2017-05-03 · Updated 2017-05-17 · CVE-2016-10367

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opsview Monitor Pro versions prior to 5.1.0.162300841 Opsview Monitor Pro versions prior to 5.0.2.27475 Opsview Monitor Pro versions prior to 4.6.4.162391051 Opsview Monitor Pro version 4.5.x without a certain 2016 security patch

Description An unauthenticated Directory Traversal issue can be exploited by issuing a specially crafted HTTP GET request. The attack utilizes a simple URL encoding bypass, using %252f instead of /.

Recommendations For versions prior to 5.1.0.162300841, update to version 5.1.0.162300841 or later. For versions prior to 5.0.2.27475, update to version 5.0.2.27475 or later. For versions prior to 4.6.4.162391051, update to version 4.6.4.162391051 or later. For version 4.5.x, apply the certain 2016 security patch to mitigate the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-10367

Affected Products

Opsview Monitor Pro

References · 3

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10367 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10367 · Vendor Advisory