CNVD-2015-00433
Vulnerability from cnvd - Published: 2016-01-05
VLAI Severity ?
Title
时光协同政务公开门户系统页面源码泄露漏洞
Description
西安协同时光软件有限公司（SYNSOFT）位于西安高新技术产业开发区园区内，是中国领先的中间件产品供应商，目前国内最完整的集成中间件系列产品提供商。
协同时光政务系统的部分页面没有完整的过滤参数”/”，攻击者利用”/”转义符号获取当前页面的源码。
Severity
中
Patch Name
时光协同通用型政务公开门户系统存在源码下载漏洞
Patch Description
按以往联系将通报发送至happy@cicro.com(张磊)和zhangqiang@cicro.com，抄送lisp@cicro.com邮箱中处置并发送对应的分中心。
Formal description
对URL中的特殊符号”/”进行严格过滤。
{
"description": "\u897f\u5b89\u534f\u540c\u65f6\u5149\u8f6f\u4ef6\u6709\u9650\u516c\u53f8\uff08SYNSOFT\uff09\u4f4d\u4e8e\u897f\u5b89\u9ad8\u65b0\u6280\u672f\u4ea7\u4e1a\u5f00\u53d1\u533a\u56ed\u533a\u5185\uff0c\u662f\u4e2d\u56fd\u9886\u5148\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u4f9b\u5e94\u5546\uff0c\u76ee\u524d\u56fd\u5185\u6700\u5b8c\u6574\u7684\u96c6\u6210\u4e2d\u95f4\u4ef6\u7cfb\u5217\u4ea7\u54c1\u63d0\u4f9b\u5546\u3002\r\n\u534f\u540c\u65f6\u5149\u653f\u52a1\u7cfb\u7edf\u7684\u90e8\u5206\u9875\u9762\u6ca1\u6709\u5b8c\u6574\u7684\u8fc7\u6ee4\u53c2\u6570\u201d/\u201d\uff0c\u653b\u51fb\u8005\u5229\u7528\u201d/\u201d\u8f6c\u4e49\u7b26\u53f7\u83b7\u53d6\u5f53\u524d\u9875\u9762\u7684\u6e90\u7801\u3002",
"discovererName": "\u738b\u632f\u5174",
"formalWay": "\u5bf9URL\u4e2d\u7684\u7279\u6b8a\u7b26\u53f7\u201d/\u201d\u8fdb\u884c\u4e25\u683c\u8fc7\u6ee4\u3002",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2015-00433",
"openTime": "2016-01-05",
"patchDescription": "\u6309\u4ee5\u5f80\u8054\u7cfb\u5c06\u901a\u62a5\u53d1\u9001\u81f3happy@cicro.com(\u5f20\u78ca)\u548czhangqiang@cicro.com\uff0c\u6284\u9001lisp@cicro.com\u90ae\u7bb1\u4e2d\u5904\u7f6e\u5e76\u53d1\u9001\u5bf9\u5e94\u7684\u5206\u4e2d\u5fc3\u3002",
"patchName": "\u65f6\u5149\u534f\u540c\u901a\u7528\u578b\u653f\u52a1\u516c\u5f00\u95e8\u6237\u7cfb\u7edf\u5b58\u5728\u6e90\u7801\u4e0b\u8f7d\u6f0f\u6d1e",
"serverity": "\u4e2d",
"submitTime": "2014-12-23",
"title": "\u65f6\u5149\u534f\u540c\u653f\u52a1\u516c\u5f00\u95e8\u6237\u7cfb\u7edf\u9875\u9762\u6e90\u7801\u6cc4\u9732\u6f0f\u6d1e"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…