The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.
References
Link | Resource |
---|---|
http://www.exploit-db.com/exploits/9717 | |
http://www.securityfocus.com/bid/36454 | Exploit |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2010-03-03T20:00:00
Updated: 2017-09-18T12:57:01
Reserved: 2010-03-03T00:00:00
Link: CVE-2009-4657
JSON object: View
NVD Information
Status : Modified
Published: 2010-03-03T20:30:00.400
Modified: 2017-09-19T01:30:00.970
Link: CVE-2009-4657
JSON object: View
Redhat Information
No data.
CWE