JVN Info.

Id
26535  
Name
JVNDB-2012-002242  
Title
VMware ESXi および ESX における任意のコードを実行される脆弱性  
Summary
VMware ESXi および ESX には、任意のコードを実行される、またはサービス運用妨害 (メモリの上書き) 状態となる脆弱性が存在します。  
Nvdinfo
CVE-2012-2448  
Cvssv2
7.5  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002242.html  
Published Date
2012-05-03  
Registered Date
2012-05-08  
Last Updated Date
2012-05-08  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
59983 H28_DWeb_NWScan_Q1_192_168_243_Seg.csv 26535 90318 CVE-2015-5351 5 Medium 192.168.243.242 tcp 9080 Apache Tomcat XSRF Token Disclosure The remote Apache Tomcat server is affected by an information disclosure vulnerability. The remote Apache Tomcat web server is affected by an information disclosure vulnerability in the index page of the Manager and Host Manager applications. An unauthenticated, remote attacker can exploit this vulnerability to obtain a valid cross-site request forgery (XSRF) token during the redirect issued when requesting /manager/ or /host-manager/. This token can be utilized by an attacker to construct an XSRF attack. Note that there are reportedly several additional vulnerabilities; however, Nessus has not tested for these. Upgrade to Apache Tomcat version 7.0.68 / 8.0.32 / 9.0.0.M3 or later. http://seclists.org/bugtraq/2016/Feb/148 http://www.nessus.org/u?77a5c04a http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.32 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.68 Nessus was able to exploit the issue using the following request : http://192.168.243.242:9080/manager/ The XSRF token found is : "044C9E50CADBF2F2AD56AC532E965600" This produced the following truncated output (limited to 10 lines) : ------------------------------ snip ------------------------------ HTTP/1.1 302 Found Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=73E9AD2DC1A3AF8B76B9B1ADECD671FA; Path=/manager/; HttpOnly Location: http://192.168.243.242:9080/manager/html;jsessionid=73E9AD2DC1A3AF8B76B9B1ADECD671FA?org.apache.catalina.filters.CSRF_NONCE=044C9E50CADBF2F2AD56AC532E965600 Content-Type: text/html;charset=ISO-8859-1 Content-Length: 0 Date: Wed, 18 May 2016 08:23:15 GMT Connection: close ------------------------------ snip ------------------------------