PT-2005-1941 · Cpg · Cpg Dragonfly

Publicado 2005-03-26 · Atualizado 2008-09-05 · CVE-2005-0914

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CPG Dragonfly version 9.0.2.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the profile parameter to "index.php" or the cat parameter.

Recommendations For CPG Dragonfly version 9.0.2.0, consider restricting access to the "index.php" endpoint and avoid using the profile and cat parameters until a fix is available. As a temporary workaround, restrict the ability to inject web script or HTML via these parameters to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-0914

Produtos afetados

Cpg Dragonfly

Referências · 3

• http://security.talte.net/content/view/252/46 · Aviso do Fabricante
• http://securitytracker.com/id?1013573 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0914 · Nota de Segurança