PT-2014-2180 · Imperva · Imperva Securesphere Web Application Firewall

Publicado 2014-09-11 · Atualizado 2017-08-29 · CVE-2011-4887

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere Web Application Firewall (WAF) version 9.0

Description A cross-site scripting (XSS) issue exists in the Violations Table of the management GUI in the MX Management Server, allowing remote attackers to inject arbitrary web script or HTML via the username field.

Recommendations For version 9.0, consider restricting access to the management GUI to minimize the risk of exploitation until a fix is available. Avoid using the username field in the Violations Table until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-4887

Produtos afetados

Imperva Securesphere Web Application Firewall

Referências · 8

• http://secureworks.com/cyber-threat-intelligence/advisories/SWRX-2012-002 · Nota
• http://imperva.com/Services/adc_advisories_response_secureworks_CVE_2011_4887 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4887 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4887 · Nota
• http://osvdb.org/79338 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73264 · Nota
• http://securityfocus.com/bid/52064 · Nota
• http://secunia.com/advisories/48086 · Nota