CVE-2014-9611
CriticalSummary
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Risk Assessment
Attackers can gain unauthorized access to the system, potentially leading to serious security breaches and loss of control over configuration.
Recommendation
It is recommended to upgrade Netsweeper to version 4.0.5 or later to mitigate this vulnerability.
Other vulnerabilities in Netsweeper
See all- CVE-2014-9619High
CVE-2014-9619 describes an unrestricted file upload vulnerability in Netsweeper that allows remote authenticated users with admin privileges to execute arbitrary PHP code by uploading a file with a double extension.
- CVE-2014-9616High
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
- CVE-2014-9605High
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
Original NVD description (English source)
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.