PT-2012-6271 · Cerberus · Cerberus Ftp Server

Catatonic · Published 2012-12-31 · Updated 2012-12-31 · CVE-2012-6339

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 5.0.6.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component. Additionally, remote authenticated administrators might be able to inject arbitrary web script or HTML via a Messages field to the servermanager program.

Recommendations For versions prior to 5.0.6.0, update to version 5.0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Log Manager component and limiting the ability of administrators to inject content via the Messages field until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-6339

Affected Products

Cerberus Ftp Server

References · 4

• 🔥 http://sadgeeksinsnow.blogspot.com/2012/12/persistence-is-key-another-bug-hunt.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6339 · Security Note
• http://cerberusftp.com/products/releasenotes.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-12/0118.html · Note