PT-2009-2115 · Opencosmo · Opencosmo Visualsentinel

Published 2009-04-07 · Updated 2018-10-11 · CVE-2008-6645

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opencosmo VisualSentinel version 0.7

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying log files. This occurs because the $ SERVER['HTTP USER AGENT'] variable is not correctly sanitized.

Recommendations For Opencosmo VisualSentinel version 0.7, consider implementing proper input validation and sanitization for the User-Agent header to prevent XSS attacks. As a temporary workaround, restrict access to log files or disable the display of the User-Agent header in log files until a proper fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-6645

Affected Products

Opencosmo Visualsentinel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-6645 · Security Note
• http://securityfocus.com/archive/1/492876/100/0/threaded · Note
• http://securityfocus.com/archive/1/492879/100/0/threaded · Note
• http://osvdb.org/51439 · Note