PT-2010-1797 · Smartertools · Smartertrack

Published 2010-08-25 · Updated 2010-08-26 · CVE-2009-4994

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterTrack versions prior to 4.0.3504

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the search parameter in the frmKBSearch.aspx file.

Recommendations For versions prior to 4.0.3504, update to version 4.0.3504 or later to resolve the issue. As a temporary workaround, consider restricting access to the frmKBSearch.aspx file to minimize the risk of exploitation. Avoid using the search parameter in the affected file until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-4994

Affected Products

Smartertrack

References · 4

• http://smartertools.com/SmarterTrack/ReleaseNotes.aspx · Patch
• http://secunia.com/advisories/36172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4994 · Security Note
• http://holisticinfosec.org/content/view/123/45 · Note