PT-2011-5082 · Smartertools · Smarterstats

Published 2011-12-16 · Updated 2017-08-29 · CVE-2011-4752

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterStats version 6.2.4100

Description The issue involves SmarterTools SmarterStats sending incorrect Content-Type headers for certain resources. This could allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files. It is possible that only clients, not the SmarterStats product, could be affected by this issue.

Recommendations For SmarterTools SmarterStats version 6.2.4100, consider restricting access to the frmCustomReport.aspx file until a fix is available. Additionally, review and correct the Content-Type headers for the affected resources to prevent potential interpretation conflicts.

Fix

Related Identifiers

CVE-2011-4752

Affected Products

Smarterstats

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4752 · Security Note
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4752 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72204 · Note