PT-2010-1457 · Accellion · Accellion Secure File Transfer Appliance

Publicado 2010-02-19 · Atualizado 2017-08-17 · CVE-2009-4647

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Accellion Secure File Transfer Appliance versions prior to 7 0 296

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the username parameter. This occurs because the parameter is not properly handled when the administrator views audit logs.

Recommendations For versions prior to 7 0 296, update to version 7 0 296 or later to resolve the issue. As a temporary workaround, consider restricting access to the audit logs until the update is applied. Avoid using the username parameter in sensitive operations until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4647

Produtos afetados

Accellion Secure File Transfer Appliance

Referências · 6

• 🔥 http://securityfocus.com/bid/38176 · Exploit
• 🔥 http://portcullis-security.com/339.php · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56247 · Nota
• http://secunia.com/advisories/38522 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4647 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4647 · Nota de Segurança