Detections
Analytics
BlueDragon 6.2.1 Multiple Remote Vulnerabilities (XSS, DoS)
medium Nessus Plugin ID 21748
Language:
Synopsis
The remote web server is prone to denial of service and cross-site scripting attacks.Description
The remote host is running BlueDragon Server / Server JX, Java-based servers for stand-alone deployment of CFML (ColdFusion Markup Language) pages.The version of BlueDragon Server / Server JX installed on the remote host fails to sanitize user-supplied input passed as part of the filename before using it in a dynamically-generated error page. An unauthenticated attacker can exploit this issue to execute arbitrary HTML and script code in a user's browser within the context of the affected application.
In addition, the server reportedly stops responding when it tries to handle a request containing an MS-DOS device name with the '.cfm' extension.
Solution
Unknown at this time.See Also
Plugin Details
Severity: Medium
ID: 21748
File Name: bluedragon_621.nasl
Version: 1.28
Type: remote
Family: CGI abuses
Published: 6/23/2006
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/a:new_atlanta_communications:bluedragon_server
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/23/2006
Reference Information
CVE: CVE-2006-2310, CVE-2006-2311