Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
BID:46452
Info
Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
| Bugtraq ID: | 46452 |
| Class: | Access Validation Error |
| CVE: |
CVE-2010-4506 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 12 2010 12:00AM |
| Updated: | Mar 04 2011 02:28PM |
| Credit: | Garrett Held of Trustwave's SpiderLabs |
| Vulnerable: |
Oracle Passlogix v-GO Self-Service Password Reset 0 |
| Not Vulnerable: |
Oracle Passlogix v-GO Self-Service Password Reset 7.0A |
Discussion
Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
Oracle Passlogix v-GO Self-Service Password Reset is prone to a remote vulnerability that allows unauthorized access.
An attacker can exploit this issue to view and execute arbitrary files on the target system. Successful exploits may aid in a compromise of the underlying computer.
Oracle Passlogix v-GO Self-Service Password Reset versions prior to 7.0A are vulnerable.
Oracle Passlogix v-GO Self-Service Password Reset is prone to a remote vulnerability that allows unauthorized access.
An attacker can exploit this issue to view and execute arbitrary files on the target system. Successful exploits may aid in a compromise of the underlying computer.
Oracle Passlogix v-GO Self-Service Password Reset versions prior to 7.0A are vulnerable.
Exploit / POC
Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
An attacker requires physical access to an affected computer to exploit this issue.
An attacker requires physical access to an affected computer to exploit this issue.
Solution / Fix
Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
Solution:
Reports indicate the vendor addressed this issue in Passlogix 7.0A and later; this has not been confirmed. Please contact the vendor for more information.
Solution:
Reports indicate the vendor addressed this issue in Passlogix 7.0A and later; this has not been confirmed. Please contact the vendor for more information.
References
Oracle Passlogix v-GO Self-Service Password Reset Unauthorized Access Vulnerability
References:
References:
- Oracle Passlogix Homepage (Oracle)
- Passlogix v-GO Self-Service Password Reset Bypass via Invalid SSL Certificate (Trustwave's SpiderLabs)