PT-2015-3495 · Pommo · Pommo Aardvark

Published 2015-01-01 · Updated 2015-01-03 · CVE-2011-5299

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions poMMo Aardvark version PR16.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through several parameters, including the referer parameter to "index.php", the site name parameter to "admin/setup/config/general.php", the group name parameter to "admin/subscribers/subscribers groups.php", or the field name parameter to "admin/setup/setup fields.php".

Recommendations For poMMo Aardvark version PR16.1, consider validating and sanitizing user input for the referer, site name, group name, and field name parameters to prevent arbitrary web script or HTML injection. As a temporary workaround, restrict access to the affected API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-5299

Affected Products

Pommo Aardvark

References · 3

• 🔥 https://htbridge.com/advisory/HTB22976 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5299 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5299 · Note