PT-2008-4669 · Citrix+1 · Citrix Xenserver Express+4

Publicado 2008-07-22 · Atualizado 2017-08-08 · CVE-2008-3253

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Citrix XenServer Express version 4.1.0 Citrix XenServer Standard Edition version 4.1.0 Citrix XenServer Enterprise Edition version 4.1.0 Citrix XenServer Dell Edition (Express) version 4.1.0 Citrix XenServer Dell Edition (Enterprise) version 4.1.0 HP integrated Citrix XenServer (Select) version 4.1.0 HP integrated Citrix XenServer (Enterprise) version 4.1.0

Description: The issue is related to a cross-site scripting (XSS) vulnerability in the XenAPI HTTP interfaces. This allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Recommendations: For Citrix XenServer Express version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Standard Edition version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Enterprise Edition version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Dell Edition (Express) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For Citrix XenServer Dell Edition (Enterprise) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For HP integrated Citrix XenServer (Select) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available. For HP integrated Citrix XenServer (Enterprise) version 4.1.0, consider restricting access to the XenAPI HTTP interfaces until a fix is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3253

Produtos afetados

Citrix Xenserver Dell Edition

Citrix Xenserver Enterprise Edition

Citrix Xenserver Express

Citrix Xenserver Standard Edition

Hp Integrated Citrix Xenserver

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3253 · Nota
• http://securitytracker.com/id?1020515 · Nota
• http://securityfocus.com/bid/30265 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43857 · Nota
• http://vupen.com/english/advisories/2008/2117/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3253 · Nota de Segurança
• http://secunia.com/advisories/31133 · Aviso do Fabricante
• http://support.citrix.com/article/CTX117814 · Nota