PT-2014-4913 · F Secure · F-Secure Messaging Secure Gateway

William Costa · Publicado 2014-04-18 · Atualizado 2014-04-21 · CVE-2014-2844

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F-Secure Messaging Secure Gateway version 7.5.0 before Patch 1862

Description A cross-site scripting (XSS) issue allows remote authenticated administrators to inject arbitrary web script or HTML via the new parameter in the SysUser module to admin. This can be achieved by accessing specific API endpoints, although the exact endpoint is not specified.

Recommendations For F-Secure Messaging Secure Gateway version 7.5.0, apply Patch 1862 to resolve the issue. As a temporary workaround, consider restricting access to the SysUser module to minimize the risk of exploitation. Avoid using the new parameter in the affected module until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-2844

Produtos afetados

F-Secure Messaging Secure Gateway

Referências · 4

• 🔥 http://seclists.org/fulldisclosure/2014/Apr/223 · Exploit
• http://secunia.com/advisories/58038 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2844 · Nota de Segurança
• http://f-secure.com/en/web/labs_global/fsc-2014-2 · Aviso do Fabricante