PT-2009-2115 · Opencosmo · Opencosmo Visualsentinel

Publicado 2009-04-07 · Atualizado 2018-10-11 · CVE-2008-6645

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opencosmo VisualSentinel version 0.7

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying log files. This occurs because the $ SERVER['HTTP USER AGENT'] variable is not correctly sanitized.

Recommendations For Opencosmo VisualSentinel version 0.7, consider implementing proper input validation and sanitization for the User-Agent header to prevent XSS attacks. As a temporary workaround, restrict access to log files or disable the display of the User-Agent header in log files until a proper fix is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-6645

Produtos afetados

Opencosmo Visualsentinel

Referências · 4

• http://securityfocus.com/archive/1/492876/100/0/threaded · Nota
• http://securityfocus.com/archive/1/492879/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6645 · Nota de Segurança
• http://osvdb.org/51439 · Nota