eFront 3.6.10 Multiple Security Vulnerabilities

Bugtraq ID:	50391
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 27 2011 12:00AM
Updated:	Oct 27 2011 12:00AM
Credit:	EgiX
Vulnerable:	eFront eFront 3.6.10 Build 11944 eFront eFront 3.6.2 eFront eFront 3.6.1 eFront eFront 3.5.5 eFront eFront 3.6.9 build 10653 eFront eFront 3.6.9 eFront eFront 3.6.3 build 7400 eFront eFront 3.6
Not Vulnerable:	eFront eFront 3.6.10 Build 12151

eFront 3.6.10 Multiple Security Vulnerabilities

eFront is prone to multiple security vulnerabilities, including:

1. A remote code injection vulnerability
2. Multiple SQL injection vulnerabilities
3. An authentication bypass and privilege escalation vulnerability
4. A remote code execution vulnerability
5. A file upload vulnerability

Attackers can exploit these issues to bypass certain security restrictions, insert arbitrary code, obtain sensitive information, execute arbitrary code, modify the logic of SQL queries, and upload arbitrary code. Other attacks may also be possible.

eFront 3.6.10 is vulnerable; prior versions may also be affected.

eFront 3.6.10 Multiple Security Vulnerabilities

Attackers can use a browser to exploit these issues.

eFront 3.6.10 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

eFront 3.6.10 Multiple Security Vulnerabilities

References:

• An update for efront 3.6.10 (eFront)
  
• eFront Homepage (eFront)