|
Hummingbird Enterprise Collaboration Multiple Vulnerabilities
An exploit is not required. The following proof of concept examples are available: To trick users into downloading a potentially malicious file, the file is named 'fake.doc', however, a file with the ID of 1189762 is actually downloaded: https://www.example.com/hc/hc/fake.doc?d=fc&o=dwnd&fid=1189762&did=89777&x=16080&doc_ext=.txt To disclose the internal IP address: https://www.example.com/hc/hc?d=mes&x=20433&ntb=[numericParam] Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie. |
|
|
Privacy Statement |
