Sign-up

ID

VAR-200605-0053


CVE

CVE-2006-2351


TITLE

Ipswitch WhatsUp Professional Multiple cross-site scripting attacks (XSS) Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200605-278

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp. WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code disclosure, cross-site scripting, and input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploits of these vulnerabilities could allow an attacker to access or modify data, steal cookie-based authentication credentials, perform username-enumeration, access sensitive information, and gain unauthorized access to script source code. Other attacks are also possible. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site. Example: http://[host]:8022/NmConsole/Navigation.asp?">[code] 2) Input passed to NmConsole/Tools.asp and NmConsole/DeviceSelection.asp is also not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site. 3) It's possible to disclose monitored devices without being logged in by passing arbitrary values to the "nDeviceGroupID" parameter in "NmConsole/utility/RenderMap.asp". Example: http://[host]:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=2 4) Input passed to the "sRedirectUrl" and "sCancelURL" in NmConsole/DeviceSelection.asp is not properly verified, which makes it possible to redirect a user to an arbitrary web site. It is also possible to disclose the source code of the ASP pages by appending a period to the end of the file extension. 5) Different error messages are returned during login to "NmConsole/Login.asp" depending on whether the supplied username or password is incorrect. 6) It is possible to disclose path information in 404 error messages returned by the service. SOLUTION: Restrict access to port 8022/tcp and don't visit other web sites while logged in. PROVIDED AND/OR DISCOVERED BY: 1, 3, 4) David Maciejak 2, 5, 6) Reported by an anonymous person. ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.35

sources: NVD: CVE-2006-2351 // BID: 17964 // VULHUB: VHN-18459 // PACKETSTORM: 46269

AFFECTED PRODUCTS

vendor:ipswitchmodel:whatsup professionalscope:eqversion:2006

Trust: 1.6

vendor:ipswitchmodel:whatsup professionalscope:eqversion:2006_premium

Trust: 1.6

vendor:ipswitchmodel:whatsup professionalscope:eqversion:20060

Trust: 0.3

sources: BID: 17964 // CNNVD: CNNVD-200605-278 // NVD: CVE-2006-2351

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-2351
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200605-278
value: MEDIUM

Trust: 0.6

VULHUB: VHN-18459
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-2351
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-18459
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-18459 // CNNVD: CNNVD-200605-278 // NVD: CVE-2006-2351

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.1

sources: VULHUB: VHN-18459 // NVD: CVE-2006-2351

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200605-278

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 46269 // CNNVD: CNNVD-200605-278

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-18459

EXTERNAL IDS
db:BIDid:17964
Trust: 2.0
db:SECUNIAid:20075
Trust: 1.8
db:VUPENid:ADV-2006-1787
Trust: 1.7
db:NVDid:CVE-2006-2351
Trust: 1.7
db:SREASONid:897
Trust: 1.7
db:OSVDBid:25470
Trust: 1.7
db:OSVDBid:25469
Trust: 1.7
db:CNNVDid:CNNVD-200605-278
Trust: 0.7
db:XFid:26500
Trust: 0.6
db:BUGTRAQid:20060511 IPSWITCH WHATSUP PROFESSIONAL MULTIPLE FLAWS
Trust: 0.6
db:EXPLOIT-DBid:27861
Trust: 0.1
db:EXPLOIT-DBid:27862
Trust: 0.1
db:SEEBUGid:SSVID-81452
Trust: 0.1
db:VULHUBid:VHN-18459
Trust: 0.1
db:PACKETSTORMid:46269
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18459 // 
            
            
            
            BID: 17964 // 
            
            
            
            PACKETSTORM: 46269 // 
            
            
            
            CNNVD: CNNVD-200605-278 // 
            
            
            
            NVD: CVE-2006-2351

REFERENCES
url:http://www.securityfocus.com/bid/17964
Trust: 1.7
url:http://www.securityfocus.com/archive/1/433808
Trust: 1.7
url:http://www.osvdb.org/25469
Trust: 1.7
url:http://www.osvdb.org/25470
Trust: 1.7
url:http://secunia.com/advisories/20075
Trust: 1.7
url:http://securityreason.com/securityalert/897
Trust: 1.7
url:http://www.vupen.com/english/advisories/2006/1787
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/26500
Trust: 1.1
url:http://www.frsirt.com/english/advisories/2006/1787
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/26500
Trust: 0.6
url:http://www.ipswitch.com/products/whatsup/professional/premium_vs_standard.asp
Trust: 0.3
url:/archive/1/433808
Trust: 0.3
url:http://secunia.com/product/9917/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://[host]:8022/nmconsole/utility/rendermap.asp?ndevicegroupid=2
Trust: 0.1
url:http://secunia.com/advisories/20075/
Trust: 0.1
url:http://secunia.com/product/9918/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://[host]:8022/nmconsole/navigation.asp?">[code]
Trust: 0.1
url:http://[host]:8022/nmconsole
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18459 // 
            
            
            
            BID: 17964 // 
            
            
            
            PACKETSTORM: 46269 // 
            
            
            
            CNNVD: CNNVD-200605-278 // 
            
            
            
            NVD: CVE-2006-2351

CREDITS
David Maciejak is credited with the discovery of these vulnerabilities.
Trust: 0.9
sources:
            
            
            BID: 17964 // 
            
            
            
            CNNVD: CNNVD-200605-278

SOURCES
db:VULHUBid:VHN-18459
db:BIDid:17964
db:PACKETSTORMid:46269
db:CNNVDid:CNNVD-200605-278
db:NVDid:CVE-2006-2351

LAST UPDATE DATE
2024-08-14T13:49:41.486000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-18459date:2017-07-20T00:00:00
db:BIDid:17964date:2006-05-16T16:24:00
db:CNNVDid:CNNVD-200605-278date:2006-05-22T00:00:00
db:NVDid:CVE-2006-2351date:2017-07-20T01:31:23.927

SOURCES RELEASE DATE
db:VULHUBid:VHN-18459date:2006-05-15T00:00:00
db:BIDid:17964date:2006-05-12T00:00:00
db:PACKETSTORMid:46269date:2006-05-17T05:39:52
db:CNNVDid:CNNVD-200605-278date:2006-05-15T00:00:00
db:NVDid:CVE-2006-2351date:2006-05-15T10:02:00