PT-2016-4926 · Greenbone · Greenbone Security Assistant

Published 2016-01-26 · Updated 2018-10-09 · CVE-2016-1926

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Greenbone Security Assistant versions 6.0.0 through 6.0.7

Description A cross-site scripting issue exists due to insufficient input validation in the charts module. This allows remote attackers to inject arbitrary web script or HTML via the aggregate type parameter in a "get aggregate" command to "omp".

Recommendations For Greenbone Security Assistant versions 6.0.0 through 6.0.7, update to version 6.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the charts module or avoiding the use of the aggregate type parameter in "get aggregate" commands to "omp" until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-1926

Affected Products

Greenbone Security Assistant

References · 9

• 🔥 https://en.internetwache.org/cve-2016-1926-xss-in-the-greenbone-security-assistant-20-01-2016 · Exploit
• https://osv.dev/vulnerability/CVE-2016-1926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1926 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183371.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184478.html · Vendor Advisory
• http://greenbone.net/technology/gbsa2016-01.html · Vendor Advisory
• http://securityfocus.com/archive/1/537335/100/0/threaded · Note
• http://packetstormsecurity.com/files/135328/OpenVAS-Greenbone-Security-Assistant-Cross-Site-Scripting.html · Note
• http://openvas.org/OVSA20160113.html · Note