PT-2007-1465 · Webapp · Webapp

Publicado 2007-04-03 · Atualizado 2008-09-05 · CVE-2006-7187

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 20060909

Description A cross-site scripting (XSS) issue exists in the show recent searches function, allowing remote attackers to inject arbitrary web script or HTML via the srch variable. This can be exploited through the /cgi-lib/user-lib/search.pl endpoint.

Recommendations For versions prior to 20060909, update to a version released after 20060909 to resolve the issue. As a temporary workaround, consider restricting access to the show recent searches function in search.pl to minimize the risk of exploitation. Avoid using the srch variable in the affected endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-7187

Produtos afetados

Webapp

Referências · 3

• http://web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7187 · Nota de Segurança
• http://web-app.net/cgi-bin/index.cgi?action=redirectd&cat=security&id=1 · Nota