certfr_avis - certa-2012-avi-466

CERTA-2012-AVI-466

Vulnerability from certfr_avis

Une vulnérabilité dans les produits EMC ApplicationXtender a été corrigée. Elle permet à un attaquant de téléverser des fichiers arbitraires sur le système. Ceux-ci peuvent ensuite être utilisés pour exécuter du code arbitraire à distance sur ce système.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Centreon	Web	EMC ApplicationXtender Web Access .NET versions 6.5 P1 et précédentes.
	Centreon	N/A	EMC ApplicationXtender Desktop versions 6.5 P1 et précédentes ;

References

Title

Publication Time

Tags

Bulletin de sécurité EMC ESA-2012-039 du 23 août 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "EMC ApplicationXtender Web Access .NET versions 6.5 P1 et pr\u00e9c\u00e9dentes.",
      "product": {
        "name": "Web",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    },
    {
      "description": "EMC ApplicationXtender Desktop versions 6.5 P1 et pr\u00e9c\u00e9dentes ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Centreon",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-2289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2289"
    }
  ],
  "initial_release_date": "2012-08-28T00:00:00",
  "last_revision_date": "2012-08-28T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-466",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-08-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans les produits EMC ApplicationXtender a \u00e9t\u00e9\ncorrig\u00e9e. Elle permet \u00e0 un attaquant de t\u00e9l\u00e9verser des fichiers\narbitraires sur le syst\u00e8me. Ceux-ci peuvent ensuite \u00eatre utilis\u00e9s pour\nex\u00e9cuter du code arbitraire \u00e0 distance sur ce syst\u00e8me.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits EMC ApplicationXtender",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 EMC ESA-2012-039 du 23 ao\u00fbt 2012",
      "url": "http://seclists.org/bugtraq/2012/Aug/att-167/ESA-2012-039.txt"
    }
  ]
}

CVE-2012-2289 (GCVE-0-2012-2289)

Vulnerability from cvelistv5

Published

2012-08-26 01:00

Modified

2024-08-06 19:26

Severity ?

CWE

Summary

EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors.

References

URL

Tags

	http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html	mailing-list, x_refsource_BUGTRAQ
	http://www.securitytracker.com/id?1027442	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:26:09.009Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20120823 ESA-2012-039: EMC ApplicationXtender Arbitrary File Upload Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html"
          },
          {
            "name": "1027442",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1027442"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-02-14T10:00:00",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "20120823 ESA-2012-039: EMC ApplicationXtender Arbitrary File Upload Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html"
        },
        {
          "name": "1027442",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1027442"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2012-2289",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20120823 ESA-2012-039: EMC ApplicationXtender Arbitrary File Upload Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0168.html"
            },
            {
              "name": "1027442",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1027442"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2012-2289",
    "datePublished": "2012-08-26T01:00:00",
    "dateReserved": "2012-04-19T00:00:00",
    "dateUpdated": "2024-08-06T19:26:09.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2012-AVI-466

Vulnerability from certfr_avis

Solution

CVE-2012-2289 (GCVE-0-2012-2289)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature