Authentication flaw

2012-08-2310:32:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.6%

JSON

The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.

CPENameOperatorVersion
websense_web_securityeq6.3.2
websense_web_securityeq7.0
websense_web_securityeq7.5
websense_web_securityeq7.1
websense_web_securityeq7.1.1
websense_web_securityeq6.3.3
websense_web_securityle7.6
websense_web_securityeq6.3.1
websense_web_securityeq7.5.1
websense_web_securityeq6.3.0

Name	Operator	Version
websense_web_security	eq	6.3.2
websense_web_security	eq	7.0
websense_web_security	eq	7.5
websense_web_security	eq	7.1
websense_web_security	eq	7.1.1
websense_web_security	eq	6.3.3
websense_web_security	le	7.6
websense_web_security	eq	6.3.1
websense_web_security	eq	7.5.1
websense_web_security	eq	6.3.0

References

www.securityfocus.com/archive/1/522530