Auth bypass in Websense Web Security
CVE-2012-4604
The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to explorer_wse/favorites.exe.
Vulnerability class: Broken Authentication
EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.
Affected products
- Websense Websense_web_security — versions 6.3.0, 6.3.1, 6.3.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, Exploit, x_refsource_BUGTRAQ)