Detections
Analytics
IBM GCM16 / GCM32 Global Console Manager KVM Switch Firmware Version < 1.20.20.23447 Multiple Vulnerabilities
high Nessus Plugin ID 77003
Language:
Synopsis
The web interface running on the remote host is affected by multiple vulnerabilities.Description
According to its self-reported version, the remote host is an IBM Global Console Manager KVM switch with a firmware version prior to 1.20.20.23447. It is, therefore, affected by the following vulnerabilities :- A reflected cross-site scripting attack via 'kvm.cgi' or 'avctalert.php'. (CVE-2014-3080)
- Unauthorized file access via the 'filename' parameter of the 'prodtest.php' script. (CVE-2014-3081)
- Remote code injection via the 'lpre' parameter of the 'systest.php' script. (CVE-2014-3085)
Solution
Upgrade to firmware version 1.20.20.23447 or later.See Also
Plugin Details
Severity: High
ID: 77003
File Name: ibm_gcm_kvm_MIGR-5095983.nasl
Version: 1.6
Type: remote
Family: Misc.
Published: 8/5/2014
Updated: 7/12/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/h:ibm:avocent_1754_kvm, cpe:/o:ibm:global_console_manager_16_firmware, cpe:/o:ibm:global_console_manager_32_firmware
Required KB Items: Host/IBM/GCM/Version, Host/IBM/GCM/Model
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/17/2014
Vulnerability Publication Date: 7/17/2014