Lucene search

[email protected]CVE-2012-4604

HistoryOct 03, 2022 - 4:15 p.m.

CVE-2012-4604

2022-10-0316:15:34

CWE-287

[email protected]

web.nvd.nist.gov

cve-2012-4604

triton

websense

web security

authentication bypass

remote attackers

uid field

userroles field

favorites.exe

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.7%

JSON

The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.

Affected configurations

NVD

Node

websensewebsense_web_securityRange≤7.6

websensewebsense_web_securityMatch6.3.0

websensewebsense_web_securityMatch6.3.1

websensewebsense_web_securityMatch6.3.2

websensewebsense_web_securityMatch6.3.3

websensewebsense_web_securityMatch7.0

websensewebsense_web_securityMatch7.1

websensewebsense_web_securityMatch7.1.1

websensewebsense_web_securityMatch7.5

websensewebsense_web_securityMatch7.5.1

CPENameOperatorVersion
websense:websense_web_securitywebsense websense web securityle7.6
websense:websense_web_securitywebsense websense web securityeq6.3.0
websense:websense_web_securitywebsense websense web securityeq6.3.1
websense:websense_web_securitywebsense websense web securityeq6.3.2
websense:websense_web_securitywebsense websense web securityeq6.3.3
websense:websense_web_securitywebsense websense web securityeq7.0
websense:websense_web_securitywebsense websense web securityeq7.1
websense:websense_web_securitywebsense websense web securityeq7.1.1
websense:websense_web_securitywebsense websense web securityeq7.5
websense:websense_web_securitywebsense websense web securityeq7.5.1

CPE	Name	Operator	Version
websense:websense_web_security	websense websense web security	le	7.6
websense:websense_web_security	websense websense web security	eq	6.3.0
websense:websense_web_security	websense websense web security	eq	6.3.1
websense:websense_web_security	websense websense web security	eq	6.3.2
websense:websense_web_security	websense websense web security	eq	6.3.3
websense:websense_web_security	websense websense web security	eq	7.0
websense:websense_web_security	websense websense web security	eq	7.1
websense:websense_web_security	websense websense web security	eq	7.1.1
websense:websense_web_security	websense websense web security	eq	7.5
websense:websense_web_security	websense websense web security	eq	7.5.1

References

www.securityfocus.com/archive/1/522530

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.7%

JSON

Related for CVE-2012-4604

prion1 nvd1 cvelist1