CVE-2015-2748 Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Securit...
MediumCVSS 5.0
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| websense triton ap data | <= 7.8.3 | No fix listed |
| websense triton ap email | <= 7.8.3 | No fix listed |
| websense triton ap web | <= 7.8.3 | No fix listed |
| websense v-series appliances | <= 7.7 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150318 Missing access control on Websense Explorer web folder mailing-list
- 20150318 Missing access control on Websense Explorer web folder mailing-list
- www.websense.com vendor-advisory
- www.securify.nl exploit