SiteScope Web Service Unpassworded Access

critical Nessus Plugin ID 10778

Synopsis

The remote administrative web server does have a password.

Description

The remote SiteScope web service has no password set. An attacker who can connect to this server can view usernames and passwords stored in the preferences section or reconfigure the service.

Solution

Make sure that a password is set in the configuration for this service. Depending on where this server is located, you may want to restrict access by IP address in addition to username.

Plugin Details

Severity: Critical

ID: 10778

File Name: DDI_Unprotected_SiteScope.nasl

Version: 1.28

Type: remote

Family: CGI abuses

Published: 9/28/2001

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/14/2002

Exploitable With

Metasploit (SNMP Community Scanner)

Reference Information

CVE: CVE-1999-0508

Detections

Analytics