CVE-2014-9605
HighSummary
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
Risk Assessment
Attackers can gain unauthorized access to the system, potentially leading to serious consequences such as data loss or service disruption.
Recommendation
It is recommended to update Netsweeper to the latest version to mitigate this vulnerability and implement additional security measures such as log monitoring and restricting access to the administrative interface.
Other vulnerabilities in Netsweeper
See all- CVE-2014-9619High
CVE-2014-9619 describes an unrestricted file upload vulnerability in Netsweeper that allows remote authenticated users with admin privileges to execute arbitrary PHP code by uploading a file with a double extension.
- CVE-2014-9616High
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
- CVE-2014-9611Critical
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Original NVD description (English source)
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.