CVE-2014-9610 Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/...
MediumCVSS 5.3
EPSS 3.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantine_disable.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netsweeper | <= 3.1.9 | No fix listed |
| netsweeper | = 4.0.0 | No fix listed |
| netsweeper | = 4.0.1 | No fix listed |
| netsweeper | = 4.0.2 | No fix listed |
| netsweeper | = 4.0.3 | No fix listed |
| netsweeper | = 4.0.4 | No fix listed |
| netsweeper | = 4.0.5 | No fix listed |
| netsweeper | = 4.0.6 | No fix listed |
| netsweeper | = 4.0.7 | No fix listed |
| netsweeper | = 4.0.8 | No fix listed |
| netsweeper | = 4.1.0 | No fix listed |
| netsweeper | = 4.1.1 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 37929 exploit third-party-advisory vdb-entry