Lucene search

MitreCVE-2013-3500

HistoryMay 08, 2013 - 12:09 p.m.

CVE-2013-3500

2013-05-0812:09:33

CWE-264

mitre

web.nvd.nist.gov

cve-2013-3500

groundwork monitor enterprise

privilege escalation

webapp

admin interface

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

68.0%

JSON

The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.

Affected configurations

Nvd

Node

gwosgroundwork_monitorMatch6.7.0-enterprise

VendorProductVersionCPE
gwosgroundwork_monitor6.7.0cpe:2.3:a:gwos:groundwork_monitor:6.7.0:-:enterprise:*:*:*:*:*

Vendor	Product	Version	CPE
gwos	groundwork_monitor	6.7.0	cpe:2.3:a:gwos:groundwork_monitor:6.7.0:-:enterprise:::::*

References

www.kb.cert.org/vuls/id/345260

kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

68.0%

JSON

Related for CVE-2013-3500