CVE-2015-2748 - Vulnerability Details - OpenCVE

Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00441.

Key SSVC decision points have not yet been added.

Vendors	Products
Websense	Triton Ap Data Triton Ap Email Triton Ap Web V-series Appliances

Configuration 1 [-]

OR	cpe:2.3:a:websense:triton_ap_data::::::::
	cpe:2.3:a:websense:triton_ap_email::::::::
	cpe:2.3:a:websense:triton_ap_web::::::::
	cpe:2.3:a:websense:v-series_appliances::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2015-2838	Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html
http://seclists.org/fulldisclosure/2015/Mar/107
http://www.securityfocus.com/archive/1/534913/100/0/threaded
http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-03-26T14:00:00

Updated: 2024-08-06T05:24:38.460Z

Reserved: 2015-03-26T00:00:00

Link: CVE-2015-2748

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-03-26T14:59:05.773

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-2748

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-03-18T00:00:00", "descriptions": [{"lang": "en", "value": "Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/534913/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2015/Mar/107"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-2748", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html"}, {"name": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0", "refsource": "CONFIRM", "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/534913/100/0/threaded"}, {"name": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html", "refsource": "MISC", "url": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2015/Mar/107"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T05:24:38.460Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/534913/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html"}, {"name": "20150318 Missing access control on Websense Explorer web folder", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2015/Mar/107"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-2748", "datePublished": "2015-03-26T14:00:00", "dateReserved": "2015-03-26T00:00:00", "dateUpdated": "2024-08-06T05:24:38.460Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:websense:triton_ap_data:*:*:*:*:*:*:*:*", "matchCriteriaId": "5124D785-F4E0-4218-99E5-3633EE4D8EA5", "versionEndIncluding": "7.8.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:websense:triton_ap_email:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1D47AEA-315E-49E3-9333-4D326FA8D703", "versionEndIncluding": "7.8.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:websense:triton_ap_web:*:*:*:*:*:*:*:*", "matchCriteriaId": "5078B495-2891-465E-BFA2-9A5C9EB8D557", "versionEndIncluding": "7.8.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:websense:v-series_appliances:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBBE6A6B-D529-4C46-91EA-4204FC3CDA43", "versionEndIncluding": "7.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file."}, {"lang": "es", "value": "Websense TRITON AP-WEB anterior a 8.0.0 no restringe correctamente el acceso a ficheros en explorer_wse/, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud directa a (1) un informe de incidentes de Web Security o (2) el fichero de configuraci\u00f3n de Explorer (websense.ini)."}], "id": "CVE-2015-2748", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-03-26T14:59:05.773", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2015/Mar/107"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/534913/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2015/Mar/107"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/534913/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}