漏洞标题
N/A
漏洞描述信息
由于Asset Explorer代理不验证HTTPS证书，网络中的攻击者可以静态配置其IP地址，以匹配Asset Explorer的服务器IP地址。这将允许攻击者向网络中的监听代理发送NewsCAN请求，以及接收代理的HTTP请求验证其授权令牌。在AEAgent.cpp中，如果HTTP响应体(POST payload)的大小过大，代理将 vulnerable to a Heap Overflow。将HTTP响应体(POST payload)转换为UTF-8使用vswprintf写入缓冲区。此写入的缓冲区大小仅为0x2000字节。如果HTTP响应体过大，则代理将发生 heap overflow。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
ZOHO ManageEngine AssetExplorer 信任管理问题漏洞
漏洞描述信息
ZOHO ManageEngine AssetExplorer是美国卓豪（ZOHO）公司的一套资产管理软件。该软件提供资产跟踪、IT资产的扫描和资产所有权的跟踪等功能。 ZOHO ManageEngine AssetExplorer 存在信任管理问题漏洞，该漏洞允许攻击者可利用该漏洞向网络上的侦听代理发送一个NEWSCAN请求，并接收代理的HTTP请求来验证其身份验证。
CVSS信息
N/A
漏洞类别
信任管理问题