PT-2007-1908 · Intersystems · Intersystems Cache

Publicado 2007-08-20 · Atualizado 2008-09-05 · CVE-2007-0437

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions InterSystems Cache (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the sample Cache Server Page (CSP) scripts. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various scripts, including the TO parameter to "loop.csp", the VALUE parameter to "cookie.csp", and the PAGE parameter to "showsource.csp". Additionally, remote authenticated users can inject arbitrary web script or HTML via the ERROR parameter to "csp/samples/xmlclasseserror.csp" and unspecified vectors in "object.csp" and "lotteryhistory.csp".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-0437

Produtos afetados

Intersystems Cache

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-0437 · Nota de Segurança
• http://mwrinfosecurity.com/news/1658.html · Nota
• http://mwrinfosecurity.com/advisories/mwri_cache-sample-files-xss-advisory_2007-04-04.pdf · Nota
• http://cpni.gov.uk/Products/alerts/2928.aspx · Nota