PT-2011-4574 · Tembria · Tembria Server Monitor

Publicado 2011-09-27 · Atualizado 2012-05-21 · CVE-2011-3684

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tembria Server Monitor versions prior to 6.0.5 Build 2252

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different ASP pages, including siteid to multiple pages, action to site-list.asp, siteid or type to event-history.asp and admin-history.asp, siteid or id to dashboard-view.asp, siteid or dn to device-events.asp, siteid or submit to device-finder.asp, siteid or dn to device-monitors.asp, siteid or type to device-views.asp and monitor-views.asp, and siteid, action, or sel to reports-list.asp, monitor-list.asp, and device-list.asp.

Recommendations For Tembria Server Monitor versions prior to 6.0.5 Build 2252, update to version 6.0.5 Build 2252 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable ASP pages until a patch is available. Avoid using the vulnerable parameters, such as siteid, action, type, id, dn, submit, and sel, in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3684

Produtos afetados

Tembria Server Monitor

Referências · 2

• 🔥 http://solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-XSS.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3684 · Nota de Segurança