| Vulnerability Name: | CVE-2006-2531 (CCN-26529) | ||||||||
| Assigned: | 2006-05-17 | ||||||||
| Published: | 2006-05-17 | ||||||||
| Updated: | 2018-10-18 | ||||||||
| Summary: | Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by setting HTTP User-Agent header to "Ipswitch/1.0" and the User-Application header to "NmConsole". | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: CCN Type: Full-Disclosure Mailing List, Wed May 17 2006 - 06:53:31 CDT What's Up Professional Spoofing Authentication Bypass Source: MITRE Type: CNA CVE-2006-2531 Source: MISC Type: UNKNOWN http://www.ftusecurity.com/pub/whatsup.public.pdf Source: CCN Type: Ipswitch, Inc. Web site WhatsUp Professional 2006 - Premium vs. Standard Source: CCN Type: OSVDB ID: 25839 Ipswitch WhatsUp Professional Crafted Header Authentication Bypass Source: BUGTRAQ Type: UNKNOWN 20060517 What's Up Professional Spoofing Authentication Bypass Source: BUGTRAQ Type: UNKNOWN 20060517 Re: [Full-disclosure] What's Up Professional Spoofing Authentication Bypass Source: BID Type: UNKNOWN 18019 Source: CCN Type: BID-18019 Ipswitch WhatsUp Professional 2006 Authentication Bypass Vulnerability Source: VUPEN Type: UNKNOWN ADV-2006-1849 Source: XF Type: UNKNOWN whatsup-http-auth-bypass(26529) Source: XF Type: UNKNOWN whatsup-http-auth-bypass(26529) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||