PT-2017-7884 · Opsview · Opsview Monitor Pro

Published 2017-05-03 · Updated 2017-05-17 · CVE-2016-10368

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Opsview Monitor Pro versions prior to 5.1.0.162300841 Opsview Monitor Pro versions prior to 5.0.2.27475 Opsview Monitor Pro versions prior to 4.6.4.162391051 Opsview Monitor Pro version 4.5.x without a certain 2016 security patch

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via the "back" parameter to the "/login" URI.

Recommendations For versions prior to 5.1.0.162300841, update to version 5.1.0.162300841 or later. For versions prior to 5.0.2.27475, update to version 5.0.2.27475 or later. For versions prior to 4.6.4.162391051, update to version 4.6.4.162391051 or later. For version 4.5.x, apply the certain 2016 security patch.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2016-10368

Affected Products

Opsview Monitor Pro

References · 3

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10368 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10368 · Vendor Advisory