CGIWrap Charset Specification Weakness Error Message XSS

This script is Copyright (C) 2008-2011 Tenable Network Security, Inc.


Synopsis :

The remote web server contains a CGI script that is affected by a
cross-site scripting vulnerability.

Description :

The remote host is running CGIWrap, a wrapper for CGI scripts to
provide enhanced security.

The version of CGIWrap installed on the remote host does not specify
a charset when responses are for error pages. An attacker may be able
to leverage this issue to inject arbitrary HTML and script code into
a user's browser to be executed whithin the security context of the
affected site. This only affects some browsers like Internet
Explorer.

See also :

http://jvn.jp/en/jp/JVN45389864/index.html
http://cgiwrap.sourceforge.net/changes.html

Solution :

Update to version 4.1 of CGIWrap.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 33279 (cgiwrap_error_page_handling_xss.nasl)

Bugtraq ID: 29811

CVE ID: CVE-2008-2852