PT-2011-5082 · Smartertools · Smarterstats

Publicado 2011-12-16 · Atualizado 2017-08-29 · CVE-2011-4752

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.2.4100

Description The issue involves SmarterTools SmarterStats sending incorrect Content-Type headers for certain resources. This could allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files. It is possible that only clients, not the SmarterStats product, could be affected by this issue.

Recommendations For SmarterTools SmarterStats version 6.2.4100, consider restricting access to the frmCustomReport.aspx file until a fix is available. Additionally, review and correct the Content-Type headers for the affected resources to prevent potential interpretation conflicts.

Correção

Identificadores relacionados

CVE-2011-4752

Produtos afetados

Smarterstats

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4752 · Nota de Segurança
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4752 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72204 · Nota