CGIWrap Charset Specification Weakness Error Message XSS

This script is Copyright (C) 2008-2011 Tenable Network Security, Inc.

Synopsis :

The remote web server contains a CGI script that is affected by a
cross-site scripting vulnerability.

Description :

The remote host is running CGIWrap, a wrapper for CGI scripts to
provide enhanced security.

The version of CGIWrap installed on the remote host does not specify
a charset when responses are for error pages. An attacker may be able
to leverage this issue to inject arbitrary HTML and script code into
a user's browser to be executed whithin the security context of the
affected site. This only affects some browsers like Internet

See also :

Solution :

Update to version 4.1 of CGIWrap.

Risk factor :

Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.6
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 33279 (cgiwrap_error_page_handling_xss.nasl)

Bugtraq ID: 29811

CVE ID: CVE-2008-2852