CVE-2021-38136

Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snapfile parameter in the /it-IT/splunkd/raw/services/getsnapshot HTTP API endpoint. A ‘low privileged’ attacker can read any file on the target host...

PT-2021-21959

Name of the Vulnerable Software and Affected Versions: Corero SecureWatch Managed Services version 9.7.2.0020 Description: The issue arises from incorrect privilege checking for swa-monitor and cns-monitor users, allowing them to perform actions outside their designated roles. Recommendations: Fo...

PT-2021-21958

Name of the Vulnerable Software and Affected Versions: Corero SecureWatch Managed Services version 9.7.2.0020 Description: The issue allows a 'low privileged' attacker to read any file on the target host via a Path Traversal vulnerability. This vulnerability can be exploited through the snap file...

CVE-2021-38137: Incorrect Authorization

Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to perform actions not belonging to his role...

CVE-2021-38136: Improper Limitation of a Pathname to a Restricted Directory

Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snapfile parameter in the /it-IT/splunkd/raw/services/getsnapshot HTTP API endpoint. A ‘low privileged’ attacker can read any file on the target host...