Detections
Analytics
Riverbed SteelApp (Stingray) Traffic Manager < 9.7 Multiple XSS
medium Nessus Plugin ID 77684
Language:
Synopsis
The remote host is affected by multiple cross-site scripting vulnerabilities.Description
The remote host is a Riverbed SteelApp (formerly known as Stingray) Traffic Manager running a version of the web user interface prior to 9.7. It is, therefore, affected by multiple cross-site scripting vulnerabilities in the 'locallog.cgi' script due to improper validation of user-supplied input to the 'logfile' parameter. A context-dependent attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the in a user's browser session.Solution
Upgrade to Riverbed SteelApp (Stingray) version 9.7.See Also
Plugin Details
Severity: Medium
ID: 77684
File Name: riverbed_stingray_webui_9_6_xss.nasl
Version: 1.5
Type: remote
Family: CGI abuses : XSS
Published: 9/15/2014
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:riverbed:steelapp_traffic_manager, cpe:/a:riverbed:stingray_traffic_manager
Required KB Items: installed_sw/Stingray Traffic Manager
Exploit Ease: No exploit is required
Patch Publication Date: 8/4/2014
Vulnerability Publication Date: 8/15/2014
Reference Information
CVE: CVE-2014-5264, CVE-2014-5348
BID: 69243