Workaround for AhsayOBS 6.x - 6.17.x.x vulnerability
Overview
The changelog for AhsayOBS 6.19.0.0 contained a mitigation for an unspecified potential vulnerability in all prior 6.x versions.
Severity
An attacker may be able to retrieve your whitelisted IP ranges, or other content of the web.xml
file. An attacker may also be able to determine the exact version of AhsayOBS in use. If you are using URL Rewriting for your AhsayOBS installation, the vulnerability can be used to retrieve your AhsayOBS credentials.
The vulnerability has a low impact; but if you are using URL Rewriting without applying IP-address restrictions to the web console, then this vulnerability is critical.
Workarounds
1. Upgrade to AhsayOBS 6.19.0.0 or later
This vulnerability has a first-party mitigation as of AhsayOBS 6.19.0.0.
2. Apply workarounds as previously detailed
The workarounds described in our article Workaround for AhsayOBS 6.x - 6.9.x.x vulnerability will protect against exploiting this vulnerability.