| Package | Affected versions | Patched versions |
|---|---|---|
| openvas manager | = 3.0= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.0.6= 4.0= 4.0.0= 4.0.1= 4.0.2= 4.0.3 |
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free