PT-2012-3570 · Forescout · Forescout Counteract

Travis Lee · Publicado 2012-06-11 · Atualizado 2012-06-12 · CVE-2012-1825

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ForeScout CounterACT appliance versions 6.3.3.2 through 6.3.4.10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the status program. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters are the loginname parameter in a forgotpass action and the username parameter.

Recommendations For ForeScout CounterACT appliance versions 6.3.3.2 through 6.3.4.10, avoid using the loginname parameter in a forgotpass action and the username parameter until a fix is available. As a temporary workaround, consider restricting access to the forgotpass action and limiting the use of the username parameter to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1825

Produtos afetados

Forescout Counteract

Referências · 3

• http://kb.cert.org/vuls/id/MAPG-8TWMEJ · Nota
• http://kb.cert.org/vuls/id/815532 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1825 · Nota de Segurança