CVE Daily

CVE-2014-9575

VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypa...

Medium CVSS 6.4

Overview

VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.

CWE: CWE-264 Published: 2015-01-08T15:59:00.047
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.4 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags