Lucene search

MitreCVE-2013-3504

HistoryMay 08, 2013 - 12:09 p.m.

CVE-2013-3504

2013-05-0812:09:33

CWE-22

mitre

web.nvd.nist.gov

cve-2013-3504

directory traversal

monarch

groundwork monitor enterprise

remote authenticated users

nagios account

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.003

Percentile

68.1%

JSON

Directory traversal vulnerability in monarch.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to overwrite arbitrary files by leveraging access to the nagios account.

Affected configurations

Nvd

Node

gwosgroundwork_monitorMatch6.7.0-enterprise

VendorProductVersionCPE
gwosgroundwork_monitor6.7.0cpe:2.3:a:gwos:groundwork_monitor:6.7.0:-:enterprise:*:*:*:*:*

Vendor	Product	Version	CPE
gwos	groundwork_monitor	6.7.0	cpe:2.3:a:gwos:groundwork_monitor:6.7.0:-:enterprise:::::*

References

www.kb.cert.org/vuls/id/345260

kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.003

Percentile

68.1%

JSON

Related for CVE-2013-3504