CVE-2012-4604 The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a c...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| websense web security | <= 7.6 | No fix listed |
| websense web security | = 6.3.0 | No fix listed |
| websense web security | = 6.3.1 | No fix listed |
| websense web security | = 6.3.2 | No fix listed |
| websense web security | = 6.3.3 | No fix listed |
| websense web security | = 7.0 | No fix listed |
| websense web security | = 7.1 | No fix listed |
| websense web security | = 7.1.1 | No fix listed |
| websense web security | = 7.5 | No fix listed |
| websense web security | = 7.5.1 | No fix listed |