PT-2002-1246 · Analogx · Analog

Publicado 2002-04-22 · Atualizado 2008-09-11 · CVE-2002-0166

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions analog versions prior to 5.22

Description The issue allows remote attackers to execute Javascript via an HTTP request containing the script. This script is entered into a web logfile and not properly filtered by analog during display, leading to a cross-site scripting issue.

Recommendations For versions prior to 5.22, update to version 5.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the web logfile to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0166

Produtos afetados

Analog

Referências · 7

• http://securityfocus.com/bid/4389 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0166 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2002-059.html · Aviso do Fabricante
• http://osvdb.org/2059 · Nota
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:02.asc · Aviso do Fabricante
• http://iss.net/security_center/static/8656.php · Nota
• http://debian.org/security/2002/dsa-125 · Aviso do Fabricante