Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus . A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication ( CVSS: 8.6 High ).
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.