vendor:
CMC-TC PU II Web management
by:
Henri Lindberg, CISA
N/A
CVSS
N/A
XSS Type I, XSS Type II, Session prediction, Remote command execution in default configuration
N/A
CWE
Product Name: CMC-TC PU II Web management
Affected Version From: V2.45
Affected Version To: V3.01
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Rittal CMC-TC Processing Unit II multiple vulnerabilities
Web application fails to validate and/or htmlencode user input when handling erroneous requests. This allows attacker to inject HTML and client-side scripts to victim's browser by creating suitable links. Web application fails to validate and/or htmlencode user input when displaying error messages. This allows attacker to inject HTML and client-side scripts to victim's browser by creating suitable requests. CMC-TC PU II uses sequential session IDs. This allows attacker to predict valid session IDs and hijack user sessions. CMC-TC PU II is shipped with default configuration which allows remote command execution. This allows attacker to execute arbitrary commands with root privileges.
Mitigation:
Vendor notified. Patch already available for XSS vulnerabilities. Other vulnerabilities will be addressed in a future version, no release date set.
