CVE-2010-2892
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 3.5%
from disclosure to weapon0 days
Published on NVDNov 15
1st PoCNov 11
exploitation probability
3.5%top 12% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencewww.exploit-db.com/exploits/15488unverifiedexploitdbwww.exploit-db.com/exploits/15488unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://community.landesk.com/support/docs/DOC-21767http://secunia.com/advisories/42188http://securitytracker.com/id?1024728http://www.coresecurity.com/content/landesk-os-command-injection-vulnerabilityhttp://www.exploit-db.com/exploits/15488http://www.securityfocus.com/archive/1/514728/100/0/threadedhttp://www.securityfocus.com/bid/44781http://www.vupen.com/english/advisories/2010/2957