PT-2012-5684 · Pattern Insight · Pattern Insight

Published 2012-11-18 · Updated 2017-08-29 · CVE-2012-4950

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pattern Insight version 2.3

Description A cross-site scripting (XSS) issue exists in the Keyword Search page of the web interface, allowing remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during the construction of error messages.

Recommendations For Pattern Insight version 2.3, consider disabling the Keyword Search page in the web interface until a patch is available to prevent exploitation of the XSS issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-4950

Affected Products

Pattern Insight

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-4950 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79787 · Note
• http://osvdb.org/87053 · Note
• http://securityfocus.com/bid/56381 · Note
• http://kb.cert.org/vuls/id/802596 · Note
• http://secunia.com/advisories/51203 · Note