PT-2015-7114 · Refbase · Refbase

Mohab Ali · Published 2015-09-28 · Updated 2015-09-29 · CVE-2015-6011

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Web Reference Database (aka refbase) versions prior to 0.9.6 and bleeding-edge versions prior to 2015-01-08

Description The issue allows remote attackers to conduct XML injection attacks. This can be achieved via two parameters: the id parameter to the "unapi.php" endpoint or the stylesheet parameter to the "sru.php" endpoint.

Recommendations For versions prior to 0.9.6, update to version 0.9.6 or later to resolve the issue. For bleeding-edge versions prior to 2015-01-08, ensure you are using a version from 2015-01-08 or later. As a temporary workaround, consider restricting access to the "unapi.php" and "sru.php" endpoints until a patch is available. Avoid using the id parameter in the "unapi.php" endpoint and the stylesheet parameter in the "sru.php" endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2015-6011

Affected Products

Refbase

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-6011 · Security Note
• http://kb.cert.org/vuls/id/374092 · Note