PT-2007-2650 · Nullsoft · Nullsoft Shoutcast Server

Publicado 2007-03-02 · Atualizado 2018-10-16 · CVE-2007-1229

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nullsoft ShoutcastServer version 1.9.7

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp). The administrator interface does not properly handle this when viewing the log file.

Recommendations For Nullsoft ShoutcastServer version 1.9.7, consider restricting access to the administrator interface and the Incoming interface on port 8001/tcp to minimize the risk of exploitation. As a temporary workaround, avoid viewing the log file in the administrator interface until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-1229

Produtos afetados

Nullsoft Shoutcast Server

Referências · 10

• 🔥 https://exploit-db.com/exploits/29685 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0604.html · Exploit
• 🔥 http://securityfocus.com/bid/22742 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1229 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32726 · Nota
• http://securityfocus.com/archive/1/461474/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/0775 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1229 · Nota
• http://osvdb.org/33793 · Nota
• http://secunia.com/advisories/24323 · Aviso do Fabricante