CVE-2014-9616
HighSummary
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
Risk Assessment
Attackers may exploit this vulnerability to disclose confidential information, potentially leading to privacy breaches and financial losses for the organization.
Recommendation
It is recommended to update Netsweeper to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Netsweeper
See all- CVE-2014-9619High
CVE-2014-9619 describes an unrestricted file upload vulnerability in Netsweeper that allows remote authenticated users with admin privileges to execute arbitrary PHP code by uploading a file with a double extension.
- CVE-2014-9605High
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
- CVE-2014-9611Critical
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Original NVD description (English source)
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.