PT-2006-7251 · Lxl · Hyperv

Aria · Published 2006-12-20 · Updated 2018-10-17 · CVE-2006-6649

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HyperVM versions 1.2 and earlier

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via an encoded frm action parameter in the display.php file. The vendor has disputed this issue, but the nature of the dispute is unclear.

Recommendations For HyperVM versions 1.2 and earlier, as a temporary workaround, consider restricting access to the display.php file until a resolution is determined, and avoid using the encoded frm action parameter in this file. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-6649

Affected Products

Hyperv

References · 7

• 🔥 http://aria-security.com/forum/showthread.php?p=89#post89 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6649 · Security Note
• http://attrition.org/pipermail/vim/2006-December/001191.html · Patch
• http://securityfocus.com/archive/1/454704/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/5062 · Note
• http://secunia.com/advisories/23413 · Note
• http://securityreason.com/securityalert/2051 · Note