A vulnerability, which was classified as critical, has been found in Adaptivecomputing Moab 7.2.8/8.0. This issue affects some unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity. The summary by CVE is:

Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message.

The weakness was published 10/08/2014 by Patrick with MWR Labs (Website). The advisory is shared at xforce.iss.net. The identification of this vulnerability is CVE-2014-5376 since 08/20/2014. The exploitation is known to be easy. The attack may be initiated remotely. A simple authentication is required for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 7.2.8 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (96700) and SecurityFocus (BID 70171†). Similar entries are available at VDB-71884 and VDB-71883.

Productinfo

Vendor

• Adaptivecomputing

Name

• Moab

Version

• 7.2.8
• 8.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion