1. CVE-Search
  2. CVE-2010-4506
ID CVE-2010-4506
Summary Passlogix v-GO Self-Service Password Reset (SSPR) and OEM before 7.0A allows physically proximate attackers to execute arbitrary programs without authentication by triggering use of an invalid SSL certificate and using the Internet Explorer interface to navigate through the filesystem via a "Save As" dialog that is reachable from the "Certificate Export" wizard.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:passlogix_v-go_self-service_password_reset_and_oem:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:passlogix_v-go_self-service_password_reset_and_oem:7.0:*:*:*:*:*:*:*
CVSS
Base: 6.2 (as of 17-08-2017 - 01:33)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:H/Au:N/C:C/I:C/A:C
refmap via4
bid 46452
misc https://www.trustwave.com/spiderlabs/advisories/TWSL2010-007.txt
sreason 8065
xf sspr-ssl-security-bypass(65439)
Last major update 17-08-2017 - 01:33
Published 07-02-2011 - 21:00
Last modified 17-08-2017 - 01:33
Back to Top