PT-2012-5672 · Pattern Insight · Pattern Insight

Published 2012-11-18 · Updated 2017-08-29 · CVE-2012-4938

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3

Description A cross-site scripting (XSS) issue exists in the web interface, allowing remote authenticated administrators to inject arbitrary web script or HTML via the banner message. This could potentially lead to unauthorized actions on the web application.

Recommendations For Pattern Insight version 2.3, consider restricting access to the web interface until a fix is available, and avoid using the banner message field to prevent potential exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-4938

Affected Products

Pattern Insight

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-4938 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79786 · Note
• http://securityfocus.com/bid/56381 · Note
• http://kb.cert.org/vuls/id/802596 · Note
• http://secunia.com/advisories/51203 · Note