CVE-2014-5362

Опубликовано: 19 сент. 2017

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Низкий

Описание

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to (1) ldms/sm_actionfrm.asp or (2) remote/frm_coremainfrm.aspx; or the (3) top parameter to remote/frm_splitfrm.aspx.

Ссылки

http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/535286/100/1100/threaded
http://www.securityfocus.com/bid/74190
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032203
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/131496/Landesk-Management-Suite-9.5-RFI-CSRF.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/535286/100/1100/threaded
http://www.securityfocus.com/bid/74190
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032203
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:landesk:landesk_management_suite:*:*:*:*:*:*:*:*

Версия до 9.6 (включая)

EPSS

Процентиль: 88%

0.03788

Низкий

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-vxv7-q37g-hwv2