CVE-2014-9616
HighSummary
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
Risk Assessment
Attackers may exploit this vulnerability to disclose confidential information, potentially leading to privacy breaches and financial losses for the organization.
Recommendation
It is recommended to update Netsweeper to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Netsweeper
See all- CVE-2014-9619High
CVE-2014-9619 describes an unrestricted file upload vulnerability in Netsweeper that allows remote authenticated users with admin privileges to execute arbitrary PHP code by uploading a file with a double extension.
- CVE-2014-9605High
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
- CVE-2014-9611Critical
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
- CVE-2015-20130Medium
Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Original NVD description (English source)
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS