Sign-up

ID

VAR-201510-0100


CVE

CVE-2015-7902


TITLE

Infinite Automation Mango Automation Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2015-005641

DESCRIPTION

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests. Infinite Automation Mango Automation is an open source web-based SCADA (data acquisition and monitoring control), HMI and automation software from Infinite Automation Systems, USA. An arbitrary-file-upload vulnerability 2. Multiple information-disclosure vulnerabilities 3. A command-execution vulnerability 4. An SQL-injection vulnerability 5. A cross-site request forgery vulnerability 6. A cross-site scripting vulnerability Attackers may leverage these issues to steal cookie-based authentication credentials, execute arbitrary script code in the browser, perform unauthorized actions, gain unauthorized access, obtain sensitive information, compromise the application, access or modify data and to execute arbitrary commands in the context of the vulnerable application; other attacks are also possible. It is easy, affordable, and open source.The application is prone to a reflected cross-sitescripting vulnerability due to a failure to properlysanitize user-supplied input to the 'username' POSTparameter in the 'login.htm' script. Mango Automation is a flexible SCADA, HMIAnd Automation software application that allows youto view, log, graph, animate, alarm, and report ondata from sensors, equipment, PLCs, databases, webpages,etc. It is easy, affordable, and open source.The weakness is caused due to the 'login.htm' scriptand how it verifies provided credentials. Attacker canuse this weakness to enumerate valid users on the affectednode.Tested on: Microsoft Windows 7 Professional SP1 (EN) 32/64bitMicrosoft Windows 7 Ultimate SP1 (EN) 32/64bitJetty(9.2.2.v20140723)Java(TM) SE Runtime Environment (build 1.8.0_51-b16)Java HotSpot(TM) Client VM (build 25.51-b03, mixed mode)

Trust: 3.15

sources: NVD: CVE-2015-7902 // JVNDB: JVNDB-2015-005641 // CNVD: CNVD-2015-07171 // BID: 77331 // IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d // ZSL: ZSL-2015-5261 // ZSL: ZSL-2015-5259 // ZSL: ZSL-2015-5258 // ZSL: ZSL-2015-5257 // ZSL: ZSL-2015-5256 // VULMON: CVE-2015-7902

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07171

AFFECTED PRODUCTS

vendor:infinite automationmodel:mango automationscope:eqversion:2.5.5

Trust: 2.2

vendor:infinite automationmodel:mango automationscope:eqversion:2.6.0

Trust: 2.2

vendor:infinite automationmodel:mango automationscope:eqversion:2.5.0

Trust: 1.6

vendor:infinite automationmodel:mango automationscope:eqversion:2.5.x

Trust: 0.8

vendor:infinite automationmodel:mango automationscope:ltversion:2.6.x

Trust: 0.8

vendor:infinite automationmodel:mango automationscope:eqversion:2.6.0 build 430

Trust: 0.8

vendor:infinite automationmodel:mango automationscope:eqversion:2.5.2 and 2.6.0 beta (build 327)

Trust: 0.5

vendor:infinitemodel:automation systems mango automationscope:eqversion:2.6.0

Trust: 0.3

vendor:infinitemodel:automation systems mango automationscope:eqversion:2.5.0

Trust: 0.3

vendor:infinitemodel:automation systems mango automation buildscope:neversion:2.6.0430

Trust: 0.3

vendor:mango automationmodel: - scope:eqversion:2.5.0

Trust: 0.2

vendor:mango automationmodel: - scope:eqversion:2.5.5

Trust: 0.2

vendor:mango automationmodel: - scope:eqversion:2.6.0

Trust: 0.2

sources: ZSL: ZSL-2015-5261 // ZSL: ZSL-2015-5259 // ZSL: ZSL-2015-5258 // ZSL: ZSL-2015-5257 // ZSL: ZSL-2015-5256 // IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07171 // BID: 77331 // JVNDB: JVNDB-2015-005641 // CNNVD: CNNVD-201510-682 // NVD: CVE-2015-7902

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7902
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-7902
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-07171
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201510-682
value: MEDIUM

Trust: 0.6

IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

ZSL: ZSL-2015-5261
value: (4/5)

Trust: 0.1

ZSL: ZSL-2015-5259
value: (4/5)

Trust: 0.1

ZSL: ZSL-2015-5258
value: (3/5)

Trust: 0.1

ZSL: ZSL-2015-5257
value: (3/5)

Trust: 0.1

ZSL: ZSL-2015-5256
value: (1/5)

Trust: 0.1

VULMON: CVE-2015-7902
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-7902
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2015-07171
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: ZSL: ZSL-2015-5261 // ZSL: ZSL-2015-5259 // ZSL: ZSL-2015-5258 // ZSL: ZSL-2015-5257 // ZSL: ZSL-2015-5256 // IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07171 // VULMON: CVE-2015-7902 // JVNDB: JVNDB-2015-005641 // CNNVD: CNNVD-201510-682 // NVD: CVE-2015-7902

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2015-005641 // NVD: CVE-2015-7902

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-682

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201510-682

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005641

EXPLOIT AVAILABILITY
sources:
            
            
            ZSL: ZSL-2015-5261 // 
            
            
            
            ZSL: ZSL-2015-5259 // 
            
            
            
            ZSL: ZSL-2015-5258 // 
            
            
            
            ZSL: ZSL-2015-5257 // 
            
            
            
            ZSL: ZSL-2015-5256 // 
            
            
            
            VULMON: CVE-2015-7902

PATCH
title:Mango Automation Core with All Features Downloadurl:http://infiniteautomation.com/index.php/download
Trust: 0.8
title:Top Pageurl:http://infiniteautomation.com/index.php/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-005641

EXTERNAL IDS
db:NVDid:CVE-2015-7902
Trust: 3.7
db:ICS CERTid:ICSA-15-300-02
Trust: 3.5
db:CNVDid:CNVD-2015-07171
Trust: 0.8
db:CNNVDid:CNNVD-201510-682
Trust: 0.8
db:JVNDBid:JVNDB-2015-005641
Trust: 0.8
db:EXPLOIT-DBid:38338
Trust: 0.6
db:ICS CERTid:ICSA-15-300-02A
Trust: 0.6
db:BIDid:77331
Trust: 0.5
db:AUSCERTid:ESB-2015.2713
Trust: 0.2
db:IVDid:6D568EC4-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:NVDid:CVE-2015-7901
Trust: 0.1
db:PACKETSTORMid:133734
Trust: 0.1
db:JVNDBid:JVNDB-2015-005640
Trust: 0.1
db:ZSLid:ZSL-2015-5261
Trust: 0.1
db:JVNDBid:JVNDB-2015-005642
Trust: 0.1
db:NVDid:CVE-2015-7903
Trust: 0.1
db:PACKETSTORMid:133732
Trust: 0.1
db:ZSLid:ZSL-2015-5259
Trust: 0.1
db:PACKETSTORMid:133731
Trust: 0.1
db:NVDid:CVE-2015-6493
Trust: 0.1
db:NSFOCUSid:31400
Trust: 0.1
db:ZSLid:ZSL-2015-5258
Trust: 0.1
db:CXSECURITYid:WLB-2015090186
Trust: 0.1
db:NVDid:CVE-2015-6494
Trust: 0.1
db:NSFOCUSid:31399
Trust: 0.1
db:PACKETSTORMid:133727
Trust: 0.1
db:ZSLid:ZSL-2015-5257
Trust: 0.1
db:CXSECURITYid:WLB-2015090185
Trust: 0.1
db:PACKETSTORMid:133726
Trust: 0.1
db:ZSLid:ZSL-2015-5256
Trust: 0.1
db:VULMONid:CVE-2015-7902
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2015-5261 // 
            
            
            
            ZSL: ZSL-2015-5259 // 
            
            
            
            ZSL: ZSL-2015-5258 // 
            
            
            
            ZSL: ZSL-2015-5257 // 
            
            
            
            ZSL: ZSL-2015-5256 // 
            
            
            
            IVD: 6d568ec4-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-07171 // 
            
            
            
            VULMON: CVE-2015-7902 // 
            
            
            
            BID: 77331 // 
            
            
            
            JVNDB: JVNDB-2015-005641 // 
            
            
            
            CNNVD: CNNVD-201510-682 // 
            
            
            
            NVD: CVE-2015-7902

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-300-02
Trust: 3.5
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7902
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7902
Trust: 0.9
url:https://www.exploit-db.com/exploits/38338/
Trust: 0.6
url:https://ics-cert.us-cert.gov/advisories/icsa-15-300-02a
Trust: 0.6
url:http://infiniteautomation.com/forum/topic/1995/mango-security-testing
Trust: 0.5
url:http://infiniteautomation.com/index.php/what-s-new/entry/what-s-new-in-mango-automation-2-6-0-released-october-20th-2016
Trust: 0.5
url:http://infiniteautomation.com/forum/topic/1997/mango-automation-2-6-released
Trust: 0.5
url:http://infiniteautomation.com/
Trust: 0.3
url:https://www.auscert.org.au/render.html?it=27342
Trust: 0.2
url:http://www.securityfocus.com/bid/77331
Trust: 0.2
url:https://packetstormsecurity.com/files/133734
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/106864
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7901
Trust: 0.1
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7901
Trust: 0.1
url:http://jvndb.jvn.jp/ja/contents/2015/jvndb-2015-005640.html
Trust: 0.1
url:http://www.securityweek.com/infinite-automation-patches-flaws-scadahmi-product
Trust: 0.1
url:https://packetstormsecurity.com/files/133732
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/106862
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7903
Trust: 0.1
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7903
Trust: 0.1
url:http://www.cvedetails.com/vendor/15200/infinite-automation-systems.html
Trust: 0.1
url:http://jvndb.jvn.jp/ja/contents/2015/jvndb-2015-005642.html
Trust: 0.1
url:https://packetstormsecurity.com/files/133731
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/106858
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6493
Trust: 0.1
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6493
Trust: 0.1
url:http://www.nsfocus.net/vulndb/31400
Trust: 0.1
url:http://chemical-facility-security-news.blogspot.com/2015/10/ics-cert-publishes-three-advisories.html
Trust: 0.1
url:https://packetstormsecurity.com/files/133727
Trust: 0.1
url:https://cxsecurity.com/issue/wlb-2015090186
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/106786
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6494
Trust: 0.1
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6494
Trust: 0.1
url:http://www.nsfocus.net/vulndb/31399
Trust: 0.1
url:https://packetstormsecurity.com/files/133726
Trust: 0.1
url:https://cxsecurity.com/issue/wlb-2015090185
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/106937
Trust: 0.1
url:http://www.cnnvd.org.cn/vulnerability/show/cv_id/2015100682
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2015-5261 // 
            
            
            
            ZSL: ZSL-2015-5259 // 
            
            
            
            ZSL: ZSL-2015-5258 // 
            
            
            
            ZSL: ZSL-2015-5257 // 
            
            
            
            ZSL: ZSL-2015-5256 // 
            
            
            
            CNVD: CNVD-2015-07171 // 
            
            
            
            VULMON: CVE-2015-7902 // 
            
            
            
            BID: 77331 // 
            
            
            
            JVNDB: JVNDB-2015-005641 // 
            
            
            
            CNNVD: CNNVD-201510-682 // 
            
            
            
            NVD: CVE-2015-7902

CREDITS
Vulnerability discovered by Gjoko Krstic
Trust: 0.5
sources:
            
            
            ZSL: ZSL-2015-5261 // 
            
            
            
            ZSL: ZSL-2015-5259 // 
            
            
            
            ZSL: ZSL-2015-5258 // 
            
            
            
            ZSL: ZSL-2015-5257 // 
            
            
            
            ZSL: ZSL-2015-5256

SOURCES
db:ZSLid:ZSL-2015-5261
db:ZSLid:ZSL-2015-5259
db:ZSLid:ZSL-2015-5258
db:ZSLid:ZSL-2015-5257
db:ZSLid:ZSL-2015-5256
db:IVDid:6d568ec4-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-07171
db:VULMONid:CVE-2015-7902
db:BIDid:77331
db:JVNDBid:JVNDB-2015-005641
db:CNNVDid:CNNVD-201510-682
db:NVDid:CVE-2015-7902

LAST UPDATE DATE
2025-04-13T23:09:45.933000+00:00

SOURCES UPDATE DATE
db:ZSLid:ZSL-2015-5261date:2016-01-04T00:00:00
db:ZSLid:ZSL-2015-5259date:2015-10-29T00:00:00
db:ZSLid:ZSL-2015-5258date:2015-10-29T00:00:00
db:ZSLid:ZSL-2015-5257date:2015-10-29T00:00:00
db:ZSLid:ZSL-2015-5256date:2015-10-29T00:00:00
db:CNVDid:CNVD-2015-07171date:2015-11-04T00:00:00
db:VULMONid:CVE-2015-7902date:2015-10-28T00:00:00
db:BIDid:77331date:2015-10-27T00:00:00
db:JVNDBid:JVNDB-2015-005641date:2015-10-29T00:00:00
db:CNNVDid:CNNVD-201510-682date:2015-10-29T00:00:00
db:NVDid:CVE-2015-7902date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:ZSLid:ZSL-2015-5261date:2015-09-26T00:00:00
db:ZSLid:ZSL-2015-5259date:2015-09-26T00:00:00
db:ZSLid:ZSL-2015-5258date:2015-09-26T00:00:00
db:ZSLid:ZSL-2015-5257date:2015-09-26T00:00:00
db:ZSLid:ZSL-2015-5256date:2015-09-26T00:00:00
db:IVDid:6d568ec4-2351-11e6-abef-000c29c66e3ddate:2015-11-02T00:00:00
db:CNVDid:CNVD-2015-07171date:2015-11-03T00:00:00
db:VULMONid:CVE-2015-7902date:2015-10-28T00:00:00
db:BIDid:77331date:2015-10-27T00:00:00
db:JVNDBid:JVNDB-2015-005641date:2015-10-29T00:00:00
db:CNNVDid:CNNVD-201510-682date:2015-10-29T00:00:00
db:NVDid:CVE-2015-7902date:2015-10-28T10:59:22.580