CVE-2010-2892

2010-11-1521:00:03

CWE-20

mitre

web.nvd.nist.gov

cve-2010-2892

landesk management gateway

remote code execution

authentication bypass

command injection

csrf attack

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

AI Score

7.3

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack.

Affected configurations

Nvd

Node

landeskmanagement_gatewayMatch4.0

landeskmanagement_gatewayMatch4.0-1.48

landeskmanagement_gatewayMatch4.2

landeskmanagement_gatewayMatch4.2-1.8

VendorProductVersionCPE
landeskmanagement_gateway4.0cpe:2.3:h:landesk:management_gateway:4.0:*:*:*:*:*:*:*
landeskmanagement_gateway4.0-1.48cpe:2.3:h:landesk:management_gateway:4.0-1.48:*:*:*:*:*:*:*
landeskmanagement_gateway4.2cpe:2.3:h:landesk:management_gateway:4.2:*:*:*:*:*:*:*
landeskmanagement_gateway4.2-1.8cpe:2.3:h:landesk:management_gateway:4.2-1.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
landesk	management_gateway	4.0	cpe:2.3:h:landesk:management_gateway:4.0:::::::*
landesk	management_gateway	4.0-1.48	cpe:2.3:h:landesk:management_gateway:4.0-1.48:::::::*
landesk	management_gateway	4.2	cpe:2.3:h:landesk:management_gateway:4.2:::::::*
landesk	management_gateway	4.2-1.8	cpe:2.3:h:landesk:management_gateway:4.2-1.8:::::::*