PT-2012-5684 · Pattern Insight · Pattern Insight

Publicado 2012-11-18 · Atualizado 2017-08-29 · CVE-2012-4950

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3

Description A cross-site scripting (XSS) issue exists in the Keyword Search page of the web interface, allowing remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during the construction of error messages.

Recommendations For Pattern Insight version 2.3, consider disabling the Keyword Search page in the web interface until a patch is available to prevent exploitation of the XSS issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-4950

Produtos afetados

Pattern Insight

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/79787 · Nota
• http://osvdb.org/87053 · Nota
• http://securityfocus.com/bid/56381 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4950 · Nota de Segurança
• http://kb.cert.org/vuls/id/802596 · Nota
• http://secunia.com/advisories/51203 · Nota