CVE-2009-0613 Missing authorization in n/a
Authenticated low-privilege users can bypass permissions to modify system configuration in Trend Micro IWSS via JSP requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-0613?
CVE-2009-0613 is a medium-severity missing authorization vulnerability in n/a, published on 17 Feb 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages.
Weakness: CWE-264
Which versions are affected by CVE-2009-0613?
It affects 1 product.
Products include Trendmicro Interscan Web Security Suite.
How do I fix CVE-2009-0613?
No fix has been published for CVE-2009-0613 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2009-0613 being exploited?
There is no known exploitation of CVE-2009-0613 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jwhg-ppr8-j6wh.