CVE-2013-3502

Gwos Groundwork Monitor - Credentials Management

Title source: rule

Description

monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by leveraging a JOSSO SSO cookie.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotelinux

https://www.exploit-db.com/exploits/25001

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Johannes Greil, juan vazquez · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb

View Code ZIP pw:eip

References (4)

[Various Sources] https://kb.groundworkopensource.com/display/SUPPORT/SA6.7.0-1+Some+web+components+allow+bypass+of+role+access+controls

[Various Sources] https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/25001

[US Government Resource] http://www.kb.cert.org/vuls/id/345260

Scores

EPSS 0.4221

EPSS Percentile 97.5%

Details

CWE

CWE-255

Status published

Products (1)

gwos/groundwork_monitor 6.7.0

Published May 08, 2013

Tracked Since Feb 18, 2026