SB2015052903 - Multiple vulnerabilities in NetCharts Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015052903

SB2015052903 - Multiple vulnerabilities in NetCharts Server

Published: May 29, 2015 Updated: August 9, 2020

Security Bulletin ID SB2015052903
CSH Severity
High
Patch available
NO
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Arbitrary file upload (CVE-ID: CVE-2014-8516)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-4032)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

projectContents.jsp in the Developer tools in Visual Mining NetCharts Server allows remote attackers to rename arbitrary files, and consequently execute them, via unspecified vectors.


3) Path traversal (CVE-ID: CVE-2015-4031)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in saveFile.jsp in the development installation in Visual Mining NetChart. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to write to arbitrary files via unspecified vectors.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References