Description
Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarms_events.php or (2) host/draw_tree.php.
References
- http://dsecrg.com/pages/vul/show.php?id=155
- 36504 vdb-entry
- 36867 third-party-advisory
- 20090923 [DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities mailing-list