PT-2012-1021 · Best Practical Solutions · Rt+1

Alex Vandiver · Publicado 2012-08-15 · Atualizado 2017-08-29 · CVE-2012-2768

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT RTFM extension versions 2.0.4 through 2.4.3 rtfm package (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the topic administration page of the RTFM extension, allowing remote attackers to inject arbitrary web script or HTML. This could lead to a breach of protected information integrity. The exploitation of these vulnerabilities can be done remotely.

Recommendations For RTFM extension versions 2.0.4 through 2.4.3, consider disabling access to the topic administration page until a patch is available. As a temporary workaround, restrict the use of the RTFM extension to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-01313

CVE-2012-2768

DSA-2535-1

Produtos afetados

Rt

Rtfm

Referências · 13

• http://secunia.com/advisories/50440 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2768 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-2768 · Aviso do Fabricante
• http://secunia.com/advisories/50024 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-2768 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2768 · Nota de Segurança
• http://securityfocus.com/bid/54689 · Nota
• https://bdu.fstec.ru/vul/2015-01313 · Nota de Segurança
• http://lists.bestpractical.com/pipermail/rt-announce/2012-July/000208.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2768 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77212 · Nota
• http://debian.org/security/dsa-2535 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2768 · Nota