PT-2007-1465 · Webapp · Webapp

Published 2007-04-03 · Updated 2008-09-05 · CVE-2006-7187

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 20060909

Description A cross-site scripting (XSS) issue exists in the show recent searches function, allowing remote attackers to inject arbitrary web script or HTML via the srch variable. This can be exploited through the /cgi-lib/user-lib/search.pl endpoint.

Recommendations For versions prior to 20060909, update to a version released after 20060909 to resolve the issue. As a temporary workaround, consider restricting access to the show recent searches function in search.pl to minimize the risk of exploitation. Avoid using the srch variable in the affected endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2006-7187

Affected Products

Webapp

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-7187 · Security Note
• http://web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=security&id=1 · Note
• http://web-app.net/cgi-bin/index.cgi?action=redirectd&cat=security&id=1 · Note