Design/Logic Flaw

2012-09-1921:55:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

Low

0.054 Low

EPSS

Percentile

93.2%

JSON

nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.

CPENameOperatorVersion
nx_web_companioneq3.0.0-1
nx_web_companioneq3.2.0-1
nx_web_companioneq3.5.0-1
nx_web_companioneq1.5.0 beta3
nx_web_companioneq3.4.0-2
nx_web_companioneq3.1.0-1
nx_web_companioneq3.4.0-1
nx_web_companioneq3.0.0-3
nx_web_companioneq3.0.0-2
nx_web_companioneq3.4.0-3

Name	Operator	Version
nx_web_companion	eq	3.0.0-1
nx_web_companion	eq	3.2.0-1
nx_web_companion	eq	3.5.0-1
nx_web_companion	eq	1.5.0 beta3
nx_web_companion	eq	3.4.0-2
nx_web_companion	eq	3.1.0-1
nx_web_companion	eq	3.4.0-1
nx_web_companion	eq	3.0.0-3
nx_web_companion	eq	3.0.0-2
nx_web_companion	eq	3.4.0-3

Rows per page:

1-10 of 181

References

archives.neohapsis.com/archives/bugtraq/2012-01/0161.html

archives.neohapsis.com/archives/fulldisclosure/2012-01/0466.html

secunia.com/advisories/47685

exchange.xforce.ibmcloud.com/vulnerabilities/72712