VAR-200605-0053

Vulnerability from variot - Updated: 2025-04-03 22:09

Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp. WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code disclosure, cross-site scripting, and input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploits of these vulnerabilities could allow an attacker to access or modify data, steal cookie-based authentication credentials, perform username-enumeration, access sensitive information, and gain unauthorized access to script source code. Other attacks are also possible. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site.

Example: http://[host]:8022/NmConsole/Navigation.asp?">[code]

2) Input passed to NmConsole/Tools.asp and NmConsole/DeviceSelection.asp is also not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a logged in user's browser session in context of a vulnerable site.

3) It's possible to disclose monitored devices without being logged in by passing arbitrary values to the "nDeviceGroupID" parameter in "NmConsole/utility/RenderMap.asp".

Example: http://[host]:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=2

4) Input passed to the "sRedirectUrl" and "sCancelURL" in NmConsole/DeviceSelection.asp is not properly verified, which makes it possible to redirect a user to an arbitrary web site.

It is also possible to disclose the source code of the ASP pages by appending a period to the end of the file extension.

5) Different error messages are returned during login to "NmConsole/Login.asp" depending on whether the supplied username or password is incorrect.

6) It is possible to disclose path information in 404 error messages returned by the service.

SOLUTION: Restrict access to port 8022/tcp and don't visit other web sites while logged in.

PROVIDED AND/OR DISCOVERED BY: 1, 3, 4) David Maciejak 2, 5, 6) Reported by an anonymous person.

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200605-0053",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "whatsup professional",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ipswitch",
        "version": "2006"
      },
      {
        "model": "whatsup professional",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ipswitch",
        "version": "2006_premium"
      },
      {
        "model": "whatsup professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ipswitch",
        "version": "20060"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "David Maciejak is credited with the discovery of these vulnerabilities.",
    "sources": [
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2006-2351",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2006-2351",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-18459",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2006-2351",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200605-278",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-18459",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp. WhatsUp Professional is prone to multiple input-validation vulnerabilities. The issues include remote file-include, information-disclosure, source-code disclosure, cross-site scripting, and input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. \nSuccessful exploits of these vulnerabilities could allow an attacker to access or modify data, steal cookie-based authentication credentials, perform username-enumeration, access sensitive information, and gain unauthorized access to script source code. Other attacks are also possible. This can be exploited to execute\narbitrary HTML and script code in a logged in user\u0027s browser session\nin context of a vulnerable site. \n\nExample:\nhttp://[host]:8022/NmConsole/Navigation.asp?\"\u003e[code]\n\n2) Input passed to NmConsole/Tools.asp and\nNmConsole/DeviceSelection.asp is also not properly sanitised before\nbeing returned to users. This can be exploited to execute arbitrary\nHTML and script code in a logged in user\u0027s browser session in context\nof a vulnerable site. \n\n3) It\u0027s possible to disclose monitored devices without being logged\nin by passing arbitrary values to the \"nDeviceGroupID\" parameter in\n\"NmConsole/utility/RenderMap.asp\". \n\nExample:\nhttp://[host]:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=2\n\n4) Input passed to the \"sRedirectUrl\" and \"sCancelURL\" in\nNmConsole/DeviceSelection.asp is not properly verified, which makes\nit possible to redirect a user to an arbitrary web site. \n\nIt is also possible to disclose the source code of the ASP pages by\nappending a period to the end of the file extension. \n\n5) Different error messages are returned during login to\n\"NmConsole/Login.asp\" depending on whether the supplied username or\npassword is incorrect. \n\n6) It is possible to disclose path information in 404 error messages\nreturned by the service. \n\nSOLUTION:\nRestrict access to port 8022/tcp and don\u0027t visit other web sites\nwhile logged in. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 3, 4) David Maciejak\n2, 5, 6) Reported by an anonymous person. \n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      },
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "PACKETSTORM",
        "id": "46269"
      }
    ],
    "trust": 1.35
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-18459",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "17964",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "20075",
        "trust": 1.8
      },
      {
        "db": "VUPEN",
        "id": "ADV-2006-1787",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351",
        "trust": 1.7
      },
      {
        "db": "SREASON",
        "id": "897",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "25470",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "25469",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278",
        "trust": 0.7
      },
      {
        "db": "XF",
        "id": "26500",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20060511 IPSWITCH WHATSUP PROFESSIONAL MULTIPLE FLAWS",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "27861",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "27862",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-81452",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-18459",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "46269",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "PACKETSTORM",
        "id": "46269"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "id": "VAR-200605-0053",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-03T22:09:50.161000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/17964"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/archive/1/433808"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/25469"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/25470"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/20075"
      },
      {
        "trust": 1.7,
        "url": "http://securityreason.com/securityalert/897"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2006/1787"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26500"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2006/1787"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/26500"
      },
      {
        "trust": 0.3,
        "url": "http://www.ipswitch.com/products/whatsup/professional/premium_vs_standard.asp"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/433808"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/9917/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://[host]:8022/nmconsole/utility/rendermap.asp?ndevicegroupid=2"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/20075/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/9918/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://[host]:8022/nmconsole/navigation.asp?\"\u003e[code]"
      },
      {
        "trust": 0.1,
        "url": "http://[host]:8022/nmconsole"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "PACKETSTORM",
        "id": "46269"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "db": "BID",
        "id": "17964"
      },
      {
        "db": "PACKETSTORM",
        "id": "46269"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-05-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "date": "2006-05-12T00:00:00",
        "db": "BID",
        "id": "17964"
      },
      {
        "date": "2006-05-17T05:39:52",
        "db": "PACKETSTORM",
        "id": "46269"
      },
      {
        "date": "2006-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "date": "2006-05-15T10:02:00",
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-18459"
      },
      {
        "date": "2006-05-16T16:24:00",
        "db": "BID",
        "id": "17964"
      },
      {
        "date": "2006-05-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      },
      {
        "date": "2025-04-03T01:03:51.193000",
        "db": "NVD",
        "id": "CVE-2006-2351"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ipswitch WhatsUp Professional Multiple cross-site scripting attacks (XSS) Vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "46269"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-278"
      }
    ],
    "trust": 0.7
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.