Solutions de vulnérabilité

L'analyse périodique de vulnérabilité Nimsoft Cloud Monitor vérifie la vulnérabilité ci-dessous. Pour connaître les solutions de vulnérabilité les plus récemment ajoutées analysées par WatchMouse, rendez-vous sur la vue d'ensemble Solutions de vulnérabilité

Catégorie: CGI abuses Facteur de risque: Medium Ajouté: 18 mars 2010
Synopsis:

An application hosted on the remote web server has a directory traversal vulnerability.

Description:

The version of OSSIM hosted on the remote host has a directory traversal vulnerability. Input to the 'file' parameter of the
'ossim/repository/download.php' script is not properly sanitized.

A remote attacker could exploit this to download arbitrary files, subject to the privileges under which the web server operates.

This version of OSSIM likely has other vulnerabilities in its web interface, though Scanner has not checked for them.

See also:

http://www.nessus.org/u?4bd9f4c5 (CYBSEC advisory, PDF)
http://www.alienvault.com/docs/2.2.1_release_notes.txt

Solution:

Upgrade to OSSIM 2.2.1 or later.

Risk factor:

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)