CPE Details
Opmantek Open-AudIT 3.3.1
3.3.1
2020-05-01
14h42 +00:00
14h42 +00:00
2020-05-01
14h42 +00:00
14h42 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:opmantek:open-audit:3.3.1:*:*:*:-:*:*:*
Informations
Vendor
opmantekProduct
open-auditVersion
3.3.1Software Edition
-Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible. | 5.9 |
Medium |
||
| An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address. | 8.8 |
High |
||
| graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | 8.8 |
High |
