Access Control Vulnerability in McAfee IntruShield Security Management System
CVE-2005-2187

Currently unrated

Key Information:

Vendor
Mcafee
Status
Intrushield Security Management System
Vendor
CVE Published:
11 July 2005

Summary

The McAfee IntruShield Security Management System contains a flaw that allows remote authenticated users to manipulate the 'Generate Reports' feature. By setting the Access option to 'true,' these users can gain unauthorized access to modify alerts. This can be achieved through parameters such as 'fullAccess' or 'fullAccessRight' in the reports-column-center.jsp file, and 'fullAccess' in the SystemEvent.jsp file. The resulting exploitation could potentially lead to unauthorized report generation and alert alterations, posing significant security risks.

References

http://marc.info/?l=bugtraq&m=112076813804503&w=2
mailing-listx_refsource_BUGTRAQ
http://securitytracker.com/id?1014422
vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/15961
third-party-advisoryx_refsource_SECUNIA

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.