Summary
Kiwi Syslog Server is prone to an information-disclosure weakness and vulnerability.
1) The weakness is due to the Web Access login page displaying different messages when invalid usernames or passwords are submitted.
This can be exploited to enumerate user accounts.
2) A security issue is due to the Cassini Explorer of the embedded UltiDev Cassini Web Server being enabled. This can be exploited to access the administrative interface and e.g. disclose the content of local files by registering a new application.
An attacker can exploit these vulnerabilities to obtain information that may aid in further attacks.
Kiwi Syslog Server 9.0.3 is vulnerable
other versions may also
be affected.
References
Updated on 2015-03-25
