NVD Vulnerability Detail

CVE-2014-9605

Summary	WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.
Publication Date	Sept. 5, 2015, 12:59 a.m.
Registration Date	Jan. 26, 2021, 3:22 p.m.
Last Update	Nov. 21, 2024, 11:21 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://helpdesk.netsweeper.com/docs/3.1/release_notes/netsweeper_releasenotes/3_1_10_0_release_notes/3.1.10_release_notes.htm	Patch Vendor Advisory
2	https://helpdesk.netsweeper.com/docs/3.1/release_notes/netsweeper_releasenotes/3_1_10_0_release_notes/3.1.10_release_notes.htm	Patch Vendor Advisory
3	https://helpdesk.netsweeper.com/docs/4.0/release_notes/netsweeper_releasenotes/4_0_9_release_notes/4.0.9_release_notes.htm	Patch Vendor Advisory
4	https://helpdesk.netsweeper.com/docs/4.0/release_notes/netsweeper_releasenotes/4_0_9_release_notes/4.0.9_release_notes.htm	Patch Vendor Advisory
5	https://helpdesk.netsweeper.com/docs/4.1/release_notes/netsweeper_releasenotes/4_1_release_notes/4_1_2_release_notes/4.1.2_release_notes.htm	Patch Vendor Advisory
6	https://helpdesk.netsweeper.com/docs/4.1/release_notes/netsweeper_releasenotes/4_1_release_notes/4_1_2_release_notes/4.1.2_release_notes.htm	Patch Vendor Advisory
7	https://www.exploit-db.com/exploits/37928/	Exploit
8	https://www.exploit-db.com/exploits/37928/	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-287	不適切な認証	https://cwe.mitre.org/data/definitions/287.html

JVN Vulnerability Information

Netsweeper の WebUpgrade における認証を回避される脆弱性

Title	Netsweeper の WebUpgrade における認証を回避される脆弱性
Summary	Netsweeper の WebUpgrade には、認証を回避され、TAR システム形式でバックアップを作成される、サーバを再起動される、またはサーバ上のフィルタをストップされる脆弱性が存在します。
Possible impacts	第三者により、webupgrade/webupgrade.php の login および password パラメータの ' (一重引用符) 文字を介して、認証を回避され、TAR システム形式でバックアップを作成される、サーバを再起動される、またはサーバ上のフィルタをストップされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 17, 2014, midnight
Registration Date	Sept. 7, 2015, 6:23 p.m.
Last Update	Sept. 7, 2015, 6:23 p.m.

Affected System

Netsweeper, Inc.

Netsweeper 3.1.10 未満

Netsweeper 4.0.9 未満の 4.0.x

Netsweeper 4.1.2 未満の 4.1.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-9605	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9605
National Vulnerability Database (NVD)
2	CVE-2014-9605	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9605

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
Netsweeper
1	3.1.10 Netsweeper Release Notes (December 17, 2014)	https://helpdesk.netsweeper.com/docs/3.1/release_notes/netsweeper_releasenotes/3_1_10_0_release_notes/3.1.10_release_notes.htm
2	4.0.9 Netsweeper Release Notes (December 17, 2014)	https://helpdesk.netsweeper.com/docs/4.0/release_notes/netsweeper_releasenotes/4_0_9_release_notes/4.0.9_release_notes.htm
3	4.1.2 Netsweeper Release Notes (Dec. 22, 2014)	https://helpdesk.netsweeper.com/docs/4.1/release_notes/netsweeper_releasenotes/4_1_release_notes/4_1_2_release_notes/4.1.2_release_notes.htm

Change Log

No	Changed Details	Date of change
0	[2015年09月07日] 掲載	Feb. 17, 2018, 10:37 a.m.