PT-2013-1682 · Red Hat+1 · Red Hat Certificate System+2

Jan Lieskovsky

·

Publicado

2013-01-04

·

Atualizado

2013-03-08

·

CVE-2012-4543

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Red Hat Certificate System versions prior to 8.1.3
Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the pageStart or pageSize to the "displayCRL" script, or the nonce variable to the "profileProcess" script.
Recommendations For versions prior to 8.1.3, update to version 8.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "displayCRL" and "profileProcess" scripts until a patch is available. Avoid using the pageStart and pageSize parameters in the "displayCRL" script and the nonce variable in the "profileProcess" script until the issue is resolved.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CESA-2013_0511
CVE-2012-4543
RHSA-2012:1550
RHSA-2013:0511
RHSA-2013_0511

Produtos afetados

Centos
Red Hat
Red Hat Certificate System