PT-2006-6974 · Bluesocket · Bluesocket Secure Controller

Jesus Olmos Gonzalez · Publicado 2006-12-07 · Atualizado 2018-10-17 · CVE-2006-6363

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlueSocket Secure Controller (BSC) versions prior to 5.2 BlueSocket Secure Controller (BSC) version 5.1 without 5.1.1-BluePatch

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ad name parameter. This can be exploited by sending malicious input to the admin.pl script.

Recommendations For BlueSocket Secure Controller (BSC) versions prior to 5.2, update to version 5.2 or later. For BlueSocket Secure Controller (BSC) version 5.1, apply the 5.1.1-BluePatch to resolve the issue. As a temporary workaround, consider restricting access to the admin.pl script to minimize the risk of exploitation. Avoid using the ad name parameter in the affected script until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-6363

Produtos afetados

Bluesocket Secure Controller

Referências · 8

• 🔥 http://securityfocus.com/bid/21419 · Exploit
• 🔥 https://exploit-db.com/exploits/29221 · Exploit
• http://securityfocus.com/archive/1/453412/100/0/threaded · Nota
• http://secunia.com/advisories/23238 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6363 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4844 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30735 · Nota
• http://securityreason.com/securityalert/1991 · Nota