PT-2006-6974 · Bluesocket · Bluesocket Secure Controller

Jesus Olmos Gonzalez · Published 2006-12-07 · Updated 2018-10-17 · CVE-2006-6363

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlueSocket Secure Controller (BSC) versions prior to 5.2 BlueSocket Secure Controller (BSC) version 5.1 without 5.1.1-BluePatch

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ad name parameter. This can be exploited by sending malicious input to the admin.pl script.

Recommendations For BlueSocket Secure Controller (BSC) versions prior to 5.2, update to version 5.2 or later. For BlueSocket Secure Controller (BSC) version 5.1, apply the 5.1.1-BluePatch to resolve the issue. As a temporary workaround, consider restricting access to the admin.pl script to minimize the risk of exploitation. Avoid using the ad name parameter in the affected script until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-6363

Affected Products

Bluesocket Secure Controller

References · 8

• 🔥 http://securityfocus.com/bid/21419 · Exploit
• 🔥 https://exploit-db.com/exploits/29221 · Exploit
• http://secunia.com/advisories/23238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6363 · Security Note
• http://securityfocus.com/archive/1/453412/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/4844 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30735 · Note
• http://securityreason.com/securityalert/1991 · Note