CVE-2015-4666

Nuclei

Xceedium Xsuite - Multiple Vulnerabilities

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-4666 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBXceedium Xsuite - Multiple VulnerabilitiesExploitDB exploitby modzeroNot analyzed1 file

linked to 6 vulnerabilities

ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMXceedium Xsuite <=2.4.4.5 - Local File InclusionCVSS 5

Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/read_sessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, disclosure of sensitive information, and potential remote code execution.

Remediation

Upgrade Xceedium Xsuite to a version higher than 2.4.4.5 or apply the necessary patches provided by the vendor.

WeaknessesCWE-22
Authors0x_Akoko
Template tagscve2015cvexceediumxsuitelfipacketstormxssvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:xceedium:xsuite:2.3.0:*:*:*:*:*:*:*
https://www.modzero.com/advisories/MZ-15-02-Xceedium-Xsuite.txt http://packetstormsecurity.com/files/132809/Xceedium-Xsuite-Command-Injection-XSS-Traversal-Escalation.html https://nvd.nist.gov/vuln/detail/CVE-2015-4666 https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html https://www.exploit-db.com/exploits/37708/

Source: ProjectDiscovery

References

5