PT-2012-5672 · Pattern Insight · Pattern Insight

Publicado 2012-11-18 · Atualizado 2017-08-29 · CVE-2012-4938

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3

Description A cross-site scripting (XSS) issue exists in the web interface, allowing remote authenticated administrators to inject arbitrary web script or HTML via the banner message. This could potentially lead to unauthorized actions on the web application.

Recommendations For Pattern Insight version 2.3, consider restricting access to the web interface until a fix is available, and avoid using the banner message field to prevent potential exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-4938

Produtos afetados

Pattern Insight

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-4938 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79786 · Nota
• http://securityfocus.com/bid/56381 · Nota
• http://kb.cert.org/vuls/id/802596 · Nota
• http://secunia.com/advisories/51203 · Nota