BID:29347

Cerberus Helpdesk Controller Authentication Information Disclosure Vulnerability

Info

Cerberus Helpdesk Controller Authentication Information Disclosure Vulnerability

Bugtraq ID:	29347
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 23 2008 12:00AM
Updated:	May 23 2008 05:24PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Cerberus Helpdesk 3.3 Cerberus Helpdesk 3.2.1 Cerberus Helpdesk 2.7 Cerberus Helpdesk 2.6.1 Cerberus Helpdesk 2.5 Cerberus Helpdesk 2.4 Cerberus Helpdesk 2.3 Cerberus Helpdesk 2.2 Cerberus Helpdesk 2.1 Cerberus Helpdesk 2.0 Cerberus Helpdesk 0.97.3 Cerberus Helpdesk 4.0

Not Vulnerable:

Discussion

Cerberus Helpdesk Controller Authentication Information Disclosure Vulnerability

Cerberus Helpdesk is prone to an information-disclosure vulnerability because of an authentication error on certain webpages.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

Exploit / POC

Cerberus Helpdesk Controller Authentication Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Cerberus Helpdesk Controller Authentication Information Disclosure Vulnerability

Solution:
The vendor released Cerberus Helpdesk 4.0 (build 600) to address the issue. Please see the references for more information.

Cerberus Helpdesk 4.0