Forest Global Training Partners

Cyber Risks · Cisco Talos

Vulnerability Spotlight: Lansweeper directory traversal and cross-site scripting vulnerabilities

Summary: Cisco Talos discovered several directory traversal and cross-site scripting vulnerabilities in Lansweeper, an IT asset management solution: two directory traversal flaws leading to arbitrary file upload (TALOS-2022-1528/CVE-2022-32573 and TALOS-2022-1529/CVE-2022-29517), two leading to arbitrary file read (TALOS-2022-1530/CVE-2022-29511 and TALOS-2022-1531/CVE-2022-27498), and two cross-site scripting sanitation bypasses leading to arbitrary JavaScript injection (TALOS-2022-1532/CVE-2022-28703 and TALOS-2022-1541/CVE-2022-32763), all triggered by HTTP requests. Talos worked with Lansweeper to resolve the issues and an update is available, but Talos tested and confirmed that Lansweeper 10.1.1.0 could still be exploited by these vulnerabilities.

Bottom line: Lansweeper inventories hardware and software across the network for management, compliance and audit, so an attacker who can upload or read arbitrary files through it reaches the system of record your asset and audit data depends on. Talos confirmed the flaws still worked against version 10.1.1.0, so checking your deployed version against that build is the concrete step.

Read the original at Cisco Talos ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2022-27498CVE-2022-28703CVE-2022-29511CVE-2022-29517CVE-2022-32573CVE-2022-32763
Related