Detections
Analytics
Xitami testssi.ssi HTTP Header XSS
medium Nessus Plugin ID 13841
Language:
Synopsis
The remote web server contains a script that is affected by a cross- site scripting flaw.Description
The remote Xitami server is distributed with a script for testing server-side includes, '/testssi.ssi'. This script is vulnerable to a cross-site scripting issue when sent a request with a malformed Host or User-Agent header. An attacker may exploit this flaw the steal the authentication credentials of third-party users.Solution
Remove the test script '/testssi.ssi'.See Also
http://www.oliverkarow.de/research/xitami25c1_testssi_XSS.txt
Plugin Details
Severity: Medium
ID: 13841
File Name: xitami_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 7/26/2004
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Exploit Available: true
Exploit Ease: No exploit is required
Reference Information
BID: 10778