Vulnerability Solutions

The Nimsoft Cloud Monitor Periodic Vulnerability Scan checks for the vulnerability below. To see the most recently added vulnerability solutions that are scanned by WatchMouse, go to the Vulnerability Solutions overview

Category: CGI abuses Risk factor: Medium Added: 18 Mar 2010
Synopsis:

An application hosted on the remote web server has a directory traversal vulnerability.

Description:

The version of OSSIM hosted on the remote host has a directory traversal vulnerability. Input to the 'file' parameter of the
'ossim/repository/download.php' script is not properly sanitized.

A remote attacker could exploit this to download arbitrary files, subject to the privileges under which the web server operates.

This version of OSSIM likely has other vulnerabilities in its web interface, though Scanner has not checked for them.

See also:

http://www.nessus.org/u?4bd9f4c5 (CYBSEC advisory, PDF)
http://www.alienvault.com/docs/2.2.1_release_notes.txt

Solution:

Upgrade to OSSIM 2.2.1 or later.

Risk factor:

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)