Lucene search
HistoryAug 23, 2012 - 10:32 a.m.
CVE-2012-4604
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
6.9
Confidence
Low
EPSS
0.004
Percentile
75.1%
The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.
Affected configurations
Node
websensewebsense_web_securityRange≤7.6
ORwebsensewebsense_web_securityMatch6.3.0
ORwebsensewebsense_web_securityMatch6.3.1
ORwebsensewebsense_web_securityMatch6.3.2
ORwebsensewebsense_web_securityMatch6.3.3
ORwebsensewebsense_web_securityMatch7.0
ORwebsensewebsense_web_securityMatch7.1
ORwebsensewebsense_web_securityMatch7.1.1
ORwebsensewebsense_web_securityMatch7.5
ORwebsensewebsense_web_securityMatch7.5.1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| websense | websense_web_security | * | cpe:2.3:a:websense:websense_web_security:*:*:*:*:*:*:*:* |
| websense | websense_web_security | 6.3.0 | cpe:2.3:a:websense:websense_web_security:6.3.0:*:*:*:*:*:*:* |
| websense | websense_web_security | 6.3.1 | cpe:2.3:a:websense:websense_web_security:6.3.1:*:*:*:*:*:*:* |
| websense | websense_web_security | 6.3.2 | cpe:2.3:a:websense:websense_web_security:6.3.2:*:*:*:*:*:*:* |
| websense | websense_web_security | 6.3.3 | cpe:2.3:a:websense:websense_web_security:6.3.3:*:*:*:*:*:*:* |
| websense | websense_web_security | 7.0 | cpe:2.3:a:websense:websense_web_security:7.0:*:*:*:*:*:*:* |
| websense | websense_web_security | 7.1 | cpe:2.3:a:websense:websense_web_security:7.1:*:*:*:*:*:*:* |
| websense | websense_web_security | 7.1.1 | cpe:2.3:a:websense:websense_web_security:7.1.1:*:*:*:*:*:*:* |
| websense | websense_web_security | 7.5 | cpe:2.3:a:websense:websense_web_security:7.5:*:*:*:*:*:*:* |
| websense | websense_web_security | 7.5.1 | cpe:2.3:a:websense:websense_web_security:7.5.1:*:*:*:*:*:*:* |
References
Related
prion
prion
Authentication flaw
2012-08-23 10:32:00
cvelist
cvelist
CVE-2012-4604
2012-08-23 10:00:00
cve
cve
CVE-2012-4604
2012-08-23 10:32:15
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
6.9
Confidence
Low
EPSS
0.004
Percentile
75.1%
Related for NVD:CVE-2012-4604