PT-2012-2128 · Titanhq · Spamtitan

Published 2012-08-31 · Updated 2012-09-03 · CVE-2011-5150

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SpamTitan versions 5.07 and earlier

Description The issue allows remote attackers or authenticated users to inject arbitrary web script or HTML. This can be achieved via the ipaddress or domain parameter to the "setup-network.php" endpoint.

Recommendations For SpamTitan versions 5.07 and earlier, consider restricting access to the "setup-network.php" endpoint until a fix is available. As a temporary workaround, avoid using the ipaddress and domain parameters in this endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-5150

Affected Products

Spamtitan

References · 5

• 🔥 https://exploit-db.com/exploits/18261 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5150 · Security Note
• http://secunia.com/advisories/47309 · Vendor Advisory
• http://osvdb.org/77989 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5150 · Note