|
CA CleverPath Portal SQL Injection Vulnerability
|
|
Secunia Advisory:
|
SA25002
|
|
|
Release Date:
|
2007-04-26
|
|
Popularity:
|
7,838 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Manipulation of data
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | CA BrightStor Portal 11.x
CA CleverPath Aion 10.x
CA CleverPath Portal 4.x
CA eTrust Security Command Center 1.x
CA eTrust Security Command Center 8.x
CA Unicenter Asset Portfolio Management 11.x
CA Unicenter Database Management Portal 11.x
CA Unicenter Management Portal 11.x
CA Unicenter Management Portal 2.x
CA Unicenter Management Portal 3.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Irene Abezgauz has reported a vulnerability in CA CleverPath Portal, which can be exploited by malicious users to conduct SQL injection attacks.
Input passed to certain parameters, e.g. the "ofinterest" parameter in the light search or the "description" parameter in the advanced search, is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Successful exploitation requires valid user credentials and that the Lite Search feature is used.
The vulnerability affects the following products:
* BrightStor Portal 11.1
* CleverPath Aion 10, 10.1, 10.2
* CleverPath Portal 4.51, 4.7, 4.71
* eTrust Security Command Center (eTrust SCC) 1, 8
* Unicenter Argis Portfolio Asset Management 11
* Unicenter Database Management Portal 11, 11.1
* Unicenter Enterprise Job Manager (UEJM) 3, 11
* Unicenter Management Portal (UMP) 2, 3.1, 11
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
