Sunhillo SureLineに認証回避の脆弱性、9.1.5で修正
Summary
Sunhillo SureLineの管理用Web画面に、ログインを素通りされる脆弱性が見つかりました。8.0.0以上9.1.5未満を使う組織が対象で、修正版は9.1.5です。管理画面にどこから届くかを確かめ、更新と並行して到達元を絞ってください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Sunhillo SureLineの管理用Web画面に、ログインを素通りされる脆弱性が見つかりました。8.0.0以上9.1.5未満を使う組織が対象で、修正版は9.1.5です。管理画面にどこから届くかを確かめ、更新と並行して到達元を絞ってください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Sunhillo Corporation | SureLine |
≥ 8.0.0, < 9.1.5 |
9.1.5 |
Original description The description as published by the source.
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web sunhillo.com
- web github.com