SiteScope Web Service Unpassworded Access

Critical Nessus Plugin ID 10778

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 5.9

Synopsis

The remote administrative web server does have a password.

Description

The remote SiteScope web service has no password set. An attacker who can connect to this server can view usernames and passwords stored in the preferences section or reconfigure the service.

Solution

Make sure that a password is set in the configuration for this service. Depending on where this server is located, you may want to restrict access by IP address in addition to username.

Plugin Details

Severity: Critical

ID: 10778

File Name: DDI_Unprotected_SiteScope.nasl

Version: 1.27

Type: remote

Family: CGI abuses

Published: 2001/09/28

Updated: 2018/06/13

Dependencies: 10107, 17975

Risk Information

Risk Factor: Critical

VPR Score: 5.9

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2002/04/14

Exploitable With

Metasploit (SNMP Community Scanner)

Reference Information

CVE: CVE-1999-0508