PT-2001-2298 · Baltimore Technologies · Websweeper

Published 2001-08-12 · Updated 2008-09-05 · CVE-2001-1157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Baltimore Technologies WEBsweeper versions 4.0 through 4.02

Description The issue allows remote attackers to bypass filtering of Javascript from HTML pages. This can be achieved by using an extra leading < and one or more characters before the SCRIPT tag, or by utilizing tags with Unicode.

Recommendations For versions 4.0 through 4.02, consider disabling the processing of Unicode tags and ensure proper filtering of Javascript from HTML pages to mitigate the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1157

Affected Products

Websweeper

References · 4

• http://securityfocus.com/bid/3173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1157 · Security Note
• http://securityfocus.com/archive/1/203821 · Vendor Advisory
• http://securityfocus.com/bid/3172 · Vendor Advisory