Detections
Analytics
OpenVAS Administrator / Manager Authentication Bypass
high Nessus Plugin ID 70919
Language:
Synopsis
The remote host is running a security scanner management service that is affected by an authentication bypass vulnerability.Description
Nessus was able to exploit an authentication bypass vulnerability by sending the 'get_version' command. Successful exploitation of this vulnerability could allow a remote attacker to take complete control of an OpenVAS install.Solution
Upgrade to OpenVAS Manager 4.0.4 / 3.0.7 or higher, and OpenVAS Administrator 1.3.2 / 1.2.2 or higher.See Also
Plugin Details
Severity: High
ID: 70919
File Name: openvas_manager_administrator_auth_bypass.nasl
Version: 1.11
Type: remote
Family: Misc.
Published: 11/15/2013
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:openvas:openvas_manager
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Patch Publication Date: 11/8/2013
Vulnerability Publication Date: 11/8/2013
Reference Information
CVE: CVE-2013-6765, CVE-2013-6766