NVD

Id
48432  
Name
CVE-2009-1135  
Description
Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
9  
Severity
High  
CVSS Base Score
9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-07-15  
Modified Date
2010-08-21  
Seq
2009-1135  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
243866 48432 CVE-2009-1135 oval:org.mitre.oval:def:5649  View
243867 48432 CVE-2009-1135 MS09-031  View
243868 48432 CVE-2009-1135 1022547  View
243869 48432 CVE-2009-1135 TA09-195A  View
243870 48432 CVE-2009-1135 ADV-2009-1889  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40911 JVNDB-2009-001917 Microsoft ISA Server における Radius OTP 使用に関する権限昇格の脆弱性 Microsoft Internet Security and Acceleration (ISA) Server には、Radius OTP を使用している場合に HTTP-Basic 認証メソッドが使われるため、任意のアカウント権限を取得される脆弱性が存在します。 CVE-2009-1135 38566 CVE-2009-1135 48432 9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001917.html 2009-07-14 2009-08-21 View