Multiple Vulnerabilities in Infovista Portal SE

Credit: P Robinson
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

---------------------------------------------------------------------- IRM Security Advisory No. 017 Multiple Vulnerabilities in Infovista Portal SE Vulnerability Type / Importance: Directory Traversal / High Information Leakage / Low Problem Discovered: January 20th 2006 Vendor Contacted: January 20th 2006 Advisory Published: February 22nd 2006 ---------------------------------------------------------------------- Abstract: VistaPortal enables secure, browser-based access to service-centric performance information. The easy implementation, display and design of Portal-based dashboards and reports give accurate visibility into the performance of the entire global IT infrastructure. VistaPortal allows users to simultaneously view Key Performance Indicators (KPIs), real-time performance notifications and strategic business information, from which users can drill down to related real-time and historical reports residing in VistaMart, the InfoVista Server and VistaTroubleshooter. VistaPortal delivers rich, interactive content within a standards-based, open architecture that allows seamless integration with existing applications and easy incorporation of information into other Web Portals. ( Description: PortalSE allows a remote attacker to read any file on the filesystem as it runs with root privileges by default. It is also susceptible to a directory revelation issue. Technical Details: During a recent research engagement IRM found multiple vulnerabilites in the Infovista PortalSE software. Using specially crafted URLs it is possible to read any file on the filesystem. This is due to the product running with super-user privileges so it is possible to gain the system's password hashes. Additionally, when selecting a non-existent server in the server field then the response reveals a full directory path, which can be useful to an attacker in fingerprinting the underlying operating system and directory structure: - An error occured while accessing the report '<nonexistentserver>_31457': No Such Report Generated For You [-] Hide details /opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.h tml (No such file or directory) /opt/InfoVista/PortalSE/files/default/<nonexistentserver>/31457/report.h tml (No such file or directory) Vendor & Patch Information: The vendor has released a hotfix for the directory traversal issue (IV00038969) which should be applied. The vendor does not deem the information leakage of the directory path an issue and has not released a hotfix for this. Tested Versions: PortalSE 2.0 Build 20087 on Solaris 8 Credits: Research & Advisory: P Robinson Disclaimer: All information in this advisory is provided on an 'as is' basis in the hope that it will be useful. Information Risk Management Plc is not responsible for any risks or occurrences caused by the application of this information.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top