PT-2014-5097 · Fog · Fog

Publicado 2014-10-21 · Atualizado 2018-10-09 · CVE-2014-3111

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FOG versions 0.27 through 0.32

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several fields, including the Printer Model field to the "Printer Management" page, the Image Name field to the "Image Management" page, the Storage Group Name field to the "Storage Management" page, the Username field to the "User Cleanup FOG Configuration" page, or the Directory Path field to the "Directory Cleaner FOG Configuration" page.

Recommendations For FOG versions 0.27 through 0.32, consider disabling the fields that allow user input to the Printer Management, Image Management, Storage Management, User Cleanup FOG Configuration, and Directory Cleaner FOG Configuration pages until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the vulnerable fields in the affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3111

Produtos afetados

Fog

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2014/May/60 · Exploit
• http://securityfocus.com/archive/1/532091/100/0/threaded · Nota
• http://fogproject.org/forum/threads/stored-xss-vulnerability-in-fog-project-version-0-27-through-0-32.10394 · Aviso do Fabricante
• http://securityfocus.com/bid/67141 · Nota
• http://openwall.com/lists/oss-security/2014/04/30/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3111 · Nota de Segurança