This script is Copyright (C) 2013 Tenable Network Security, Inc.
A web application hosted on the remote web server contains
The version of Cerb installed on the remote host is earlier than
6.2.5. It is, therefore, affected by multiple vulnerabilities:
- A flaw exists in that the application does not validate
input passed via HTML email attachments, making it
vulnerable to XSS. An attacker could exploit this
issue to inject arbitrary HTML and script code into a
user's browser to be executed within the security
context of the affected site.
- A flaw exists in the 'Remember me' cookie for the login
process that could potentially disclose information to
a malicious script in a browser.
See also :
Update to Cerb 6.2.5 or later.
Risk factor :
Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.6
Public Exploit Available : true
Family: CGI abuses : XSS
Nessus Plugin ID: 65984 ()
Bugtraq ID: 58281