PT-2015-5770 · Microsoft · Biztalk Server 2013 R2+3

Publicado 2015-08-15 · Atualizado 2018-10-12 · CVE-2015-2475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2 BizTalk Server 2010 BizTalk Server 2013 Gold BizTalk Server 2013 R2

Description A cross-site scripting (XSS) issue exists in the UDDI Services component, allowing remote attackers to inject arbitrary web script or HTML via the search parameter in uddi/search/frames.aspx. This enables attackers to potentially elevate privileges.

Recommendations For Microsoft Windows Server 2008 SP2, update to a version that includes the fix for this issue. For BizTalk Server 2010, apply the patch that addresses the UDDI Services Elevation of Privilege issue. For BizTalk Server 2013 Gold and 2013 R2, restrict access to the uddi/search/frames.aspx endpoint until a patch is applied, and avoid using the search parameter in this endpoint to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-2475

Produtos afetados

Biztalk Server 2010

Biztalk Server 2013 Gold

Biztalk Server 2013 R2

Windows Server 2008 R2

Referências · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-087 · Aviso do Fabricante
• http://securitytracker.com/id/1033246 · Nota
• http://securityfocus.com/bid/76259 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2475 · Nota de Segurança