Cerb Multiple Vulnerabilities

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

A web application hosted on the remote web server contains
multiple vulnerabilities.

Description :

The version of Cerb installed on the remote host is earlier than
6.2.5. It is, therefore, affected by multiple vulnerabilities:

- A flaw exists in that the application does not validate
input passed via HTML email attachments, making it
vulnerable to XSS. An attacker could exploit this
issue to inject arbitrary HTML and script code into a
user's browser to be executed within the security
context of the affected site.

- A flaw exists in the 'Remember me' cookie for the login
process that could potentially disclose information to
a malicious script in a browser.

See also :

http://wiki.cerbweb.com/6.2#6.2.5
http://www.nessus.org/u?535bc8ce
http://www.nessus.org/u?0c5ab580

Solution :

Update to Cerb 6.2.5 or later.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 65984 ()

Bugtraq ID: 58281

CVE ID: