PT-2012-4382 · Yandex · Yandex.Server 2010

Publicado 2012-05-27 · Atualizado 2017-08-29 · CVE-2012-2941

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yandex.Server 2010 version 9.0 Enterprise

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the text parameter in the search functionality.

Recommendations For Yandex.Server 2010 version 9.0 Enterprise, consider restricting access to the search functionality until a fix is available. As a temporary workaround, avoid using the text parameter in the affected search endpoint to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-2941

Produtos afetados

Yandex.Server 2010

Referências · 5

• 🔥 http://securityfocus.com/bid/53622 · Exploit
• 🔥 https://exploit-db.com/exploits/37224 · Exploit
• http://packetstormsecurity.org/files/112945/Yandex.Server-2010-9.0-Enterprise-Cross-Site-Scripting.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2941 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75788 · Nota