PT-2014-2180 · Imperva · Imperva Securesphere Web Application Firewall

Published 2014-09-11 · Updated 2017-08-29 · CVE-2011-4887

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Imperva SecureSphere Web Application Firewall (WAF) version 9.0

Description A cross-site scripting (XSS) issue exists in the Violations Table of the management GUI in the MX Management Server, allowing remote attackers to inject arbitrary web script or HTML via the username field.

Recommendations For version 9.0, consider restricting access to the management GUI to minimize the risk of exploitation until a fix is available. Avoid using the username field in the Violations Table until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-4887

Affected Products

Imperva Securesphere Web Application Firewall

References · 8

• http://imperva.com/Services/adc_advisories_response_secureworks_CVE_2011_4887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4887 · Security Note
• http://secureworks.com/cyber-threat-intelligence/advisories/SWRX-2012-002 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4887 · Note
• http://osvdb.org/79338 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73264 · Note
• http://securityfocus.com/bid/52064 · Note
• http://secunia.com/advisories/48086 · Note