CVE-2013-0651: Medium severity ge proficy real-time information portal vulnerability
The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0651?
CVE-2013-0651 is classified as having a medium severity due to its potential to expose sensitive configuration files.
How do I fix CVE-2013-0651?
To fix CVE-2013-0651, ensure that sensitive configuration files are stored outside the web root and implement proper access controls.
What systems are affected by CVE-2013-0651?
CVE-2013-0651 affects GE Intelligent Platforms Proficy Real-Time Information Portal versions 2.6, 3.0, 3.0-sp1, 3.5, and 3.5-sp1.
What type of information could be exposed due to CVE-2013-0651?
CVE-2013-0651 could potentially expose sensitive data-source credentials stored in configuration files.
Is there a workaround for CVE-2013-0651?
While the recommended fix is to secure file access, temporarily restricting access to the web root directory can serve as a workaround.