PT-2012-6271 · Cerberus · Cerberus Ftp Server

Catatonic · Publicado 2012-12-31 · Atualizado 2012-12-31 · CVE-2012-6339

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 5.0.6.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component. Additionally, remote authenticated administrators might be able to inject arbitrary web script or HTML via a Messages field to the servermanager program.

Recommendations For versions prior to 5.0.6.0, update to version 5.0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Manager component and limiting the ability of administrators to inject content via the Messages field until a patch is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-6339

Produtos afetados

Cerberus Ftp Server

Referências · 4

• 🔥 http://sadgeeksinsnow.blogspot.com/2012/12/persistence-is-key-another-bug-hunt.html · Exploit
• http://cerberusftp.com/products/releasenotes.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-12/0118.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6339 · Nota de Segurança