PT-2016-4926 · Greenbone · Greenbone Security Assistant

Publicado 2016-01-26 · Atualizado 2018-10-09 · CVE-2016-1926

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Greenbone Security Assistant versions 6.0.0 through 6.0.7

Description A cross-site scripting issue exists due to insufficient input validation in the charts module. This allows remote attackers to inject arbitrary web script or HTML via the aggregate type parameter in a "get aggregate" command to "omp".

Recommendations For Greenbone Security Assistant versions 6.0.0 through 6.0.7, update to version 6.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the charts module or avoiding the use of the aggregate type parameter in "get aggregate" commands to "omp" until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-1926

Produtos afetados

Greenbone Security Assistant

Referências · 9

• 🔥 https://en.internetwache.org/cve-2016-1926-xss-in-the-greenbone-security-assistant-20-01-2016 · Exploit
• https://osv.dev/vulnerability/CVE-2016-1926 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1926 · Nota de Segurança
• http://securityfocus.com/archive/1/537335/100/0/threaded · Nota
• http://packetstormsecurity.com/files/135328/OpenVAS-Greenbone-Security-Assistant-Cross-Site-Scripting.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183371.html · Aviso do Fabricante
• http://openvas.org/OVSA20160113.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184478.html · Aviso do Fabricante
• http://greenbone.net/technology/gbsa2016-01.html · Aviso do Fabricante