url_placeholder/administrator/edit.do?userID=x

where x is any value between 1 and the maximum number of user accounts n. This allows harvesting user information, such as user name IDs and e-mail addresses.

A vulnerability in the code used to create new user accounts could allow an authenticated underprivileged attacker (with minimum privileges) to create new valid accounts with full administrative privileges. This could be effectively used by an attacker to take control of the appliance

An authenticated underprivileged attacker could access the resources used to initially configure the security appliances, thus compromising the appliance’s network and monitoring settings:

        url_placeholder/setup/SiteSetupAppliance$exec.flo?flowId=0

Affected Versions