PT-2007-7181 · Websense · Websense Enterprise/Web Security Suite

Publicado 2007-12-11 · Atualizado 2018-10-15 · CVE-2007-6312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Websense Enterprise and Web Security Suite version 6.3

Description A cross-site scripting (XSS) issue exists in the logon page of the Web Reporting Tools portal, allowing remote attackers to inject arbitrary web script or HTML via the username field.

Recommendations For Websense Enterprise and Web Security Suite version 6.3, consider restricting access to the logon page of the Web Reporting Tools portal until a fix is available, and avoid using the username field in a way that could facilitate XSS attacks.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6312

Produtos afetados

Websense Enterprise/Web Security Suite

Referências · 10

• http://vupen.com/english/advisories/2007/4158 · Nota
• http://securityfocus.com/archive/1/484824/100/0/threaded · Nota
• http://securityreason.com/securityalert/3432 · Nota
• http://liquidmatrix.org/blog/2007/12/10/advisory-websense-xss-vulnerability · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-6312 · Nota de Segurança
• http://securityfocus.com/bid/26793 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38936 · Nota
• http://secunia.com/advisories/28019 · Nota
• http://securitytracker.com/id?1019066 · Nota
• http://websense.com/SupportPortal/SupportKbs/1840.aspx · Correção