PT-2010-1967 · Ibm · Ibm Proventia Network Mail Security System
Publicado
2010-09-14
·
Atualizado
2018-10-10
·
CVE-2010-0152
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
IBM Proventia Network Mail Security System appliance versions prior to 2.5.0.2
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Local Management Interface (LMI) of the IBM Proventia Network Mail Security System appliance. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various parameters, including
date1 to "pvm messagestore.php", userfilter to "pvm user management.php", ping to "sys tools.php" in a "sys ping.php" action, action to "pvm cert commaction.php", action to "pvm cert serveraction.php", action to "pvm smtpstore.php", and l to "sla/index.php". Additionally, remote authenticated users can inject arbitrary web script or HTML via saved search filters.Recommendations
For versions prior to 2.5.0.2, update to firmware version 2.5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the LMI and limiting the use of the affected parameters, such as
date1, userfilter, ping, action, and l, until the update is applied. Avoid using saved search filters in the LMI until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ibm Proventia Network Mail Security System