Cerb Multiple Vulnerabilities

This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.

Synopsis :

A web application hosted on the remote web server contains
multiple vulnerabilities.

Description :

The version of Cerb installed on the remote host is earlier than
6.2.5. It is, therefore, affected by multiple vulnerabilities:

- A flaw exists in that the application does not validate
input passed via HTML email attachments, making it
vulnerable to XSS. An attacker could exploit this
issue to inject arbitrary HTML and script code into a
user's browser to be executed within the security
context of the affected site.

- A flaw exists in the 'Remember me' cookie for the login
process that could potentially disclose information to
a malicious script in a browser.

See also :


Solution :

Update to Cerb 6.2.5 or later.

Risk factor :

Medium / CVSS Base Score : 4.3
CVSS Temporal Score : 3.6
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 65984 ()

Bugtraq ID: 58281


Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now