PT-2010-3846 · Gambit Design · Gambit Design Bandwidth Meter

Publicado 2010-06-09 · Atualizado 2017-08-17 · CVE-2010-2260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gambit Design Bandwidth Meter versions 0.72 through 1.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to (1) "view by name.php" or (2) "view by ip.php" in the "admin/" directory.

Recommendations For Gambit Design Bandwidth Meter versions 0.72 through 1.2, consider restricting access to the "view by name.php" and "view by ip.php" files in the "admin/" directory until a fix is available. Avoid using the PATH INFO to inject web script or HTML in these files.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2260

Produtos afetados

Gambit Design Bandwidth Meter

Referências · 5

• 🔥 http://packetstormsecurity.org/1001-exploits/bandwidthmeter-xss.txt · Exploit
• 🔥 http://exploit-db.com/exploits/10926 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55307 · Nota
• http://secunia.com/advisories/38012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2260 · Nota de Segurança