Unscored CVE-2013-6766 EUVD-2013-6568GHSA-jfxq-6qfr-g8m8

OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execu…

Published May 19, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENT_AUTHENTIC.

References

[Openvas-announce] 20131108 Security Releases for OpenVAS-5 and OpenVAS-6 mailing-list
[oss-security] 20131110 CVE-2013-6765 CVE-2013-6766 for OpenVAS 4.0.4/1.3.2/etc. mailing-list
http://www.openvas.org/OVSA20131108.html