Landesk Management Suite Remote File Include And Cross Site Request Forgery Vulnerabilities
BID:74190
CVE-2014-5362 |Info
Landesk Management Suite Remote File Include And Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 74190 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-5361 CVE-2014-5362 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2015 12:00AM |
| Updated: | Apr 16 2015 12:00AM |
| Credit: | Alex Haynes |
| Vulnerable: |
LANDesk Software LANDesk Management Suite 9.5 |
| Not Vulnerable: | |
Discussion
Landesk Management Suite Remote File Include And Cross Site Request Forgery Vulnerabilities
Landesk Management Suite is prone to multiple remote file-include vulnerabilities and a cross-site request-forgery vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process and to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.
Landesk Management Suite is prone to multiple remote file-include vulnerabilities and a cross-site request-forgery vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process and to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.