PT-2015-3508 · Gollos · Gollos

Publicado 2015-01-01 · Atualizado 2015-01-02 · CVE-2011-5312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Gollos version 2.8

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the returnurl parameter to API endpoints such as "register.aspx", "publication/info.aspx", or "user/add.aspx", or the q parameter to "product/list.aspx".

Recommendations For Gollos version 2.8, as a temporary workaround, consider restricting access to the returnurl parameter in the affected API endpoints and the q parameter in "product/list.aspx" until a patch is available. Avoid using the returnurl and q parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-5312

Produtos afetados

Gollos

Referências · 2

• 🔥 https://htbridge.com/advisory/HTB22830 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5312 · Nota de Segurança