Detections
Analytics
Cerb Multiple Vulnerabilities
medium Nessus Plugin ID 65984
Language:
Synopsis
A web application hosted on the remote web server contains multiple vulnerabilities.Description
The version of Cerb installed on the remote host is earlier than 6.2.5. It is, therefore, affected by multiple vulnerabilities:- A flaw exists in that the application does not validate input passed via HTML email attachments, making it vulnerable to XSS. An attacker could exploit this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.
- A flaw exists in the 'Remember me' cookie for the login process that could potentially disclose information to a malicious script in a browser.
Solution
Update to Cerb 6.2.5 or later.See Also
http://wiki.cerbweb.com/6.2#6.2.5
Plugin Details
Severity: Medium
ID: 65984
File Name: cerberus_6_2_5.nasl
Version: 1.7
Type: remote
Family: CGI abuses : XSS
Published: 4/3/2013
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:cerberus:cerberus_helpdesk
Required KB Items: www/PHP, www/cerb
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/26/2013
Vulnerability Publication Date: 2/26/2013
Reference Information
BID: 58281