PT-2009-4082 · Armorlogic · Armorlogic Profense Web Application Firewall

Sandro Gauci + 1 · Publicado 2009-05-21 · Atualizado 2018-10-10 · CVE-2009-1594

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Armorlogic Profense Web Application Firewall versions before 2.2.22 Armorlogic Profense Web Application Firewall versions 2.4.x before 2.4.4

Description: The issue allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline) in a URL, such as in a cross-site scripting (XSS) attack. This is due to the improper implementation of the "positive model".

Recommendations: For versions before 2.2.22, update to version 2.2.22 or later to resolve the issue. For versions 2.4.x before 2.4.4, update to version 2.4.4 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1594

Produtos afetados

Armorlogic Profense Web Application Firewall

Referências · 6

• http://securityfocus.com/archive/1/503649/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50662 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1594 · Nota de Segurança
• http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt · Nota
• http://webappsec.org/lists/websecurity/archive/2009-05/msg00040.html · Nota
• http://securityfocus.com/bid/35053 · Nota