Detections
Analytics

macOS : macOS Server < 5.11 XSS (HT211932)

medium Nessus Plugin ID 146823

Language:

Synopsis

The remote host is missing a security update for macOS Server.

Description

The version of macOS Server (formerly known as Mac OS X Server) installed on the remote host is prior to 5.11. It is, therefore, affected by an open redirect or cross-site scripting (XSS) vulnerability due to an issue in the parsing of URLs. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

Solution

Upgrade to macOS Server version 5.11 or later. Note that macOS Server version 5.11 is available only for macOS 11 (Big Sur) or later.

See Also

https://support.apple.com/en-us/HT211932

Plugin Details

Severity: Medium

ID: 146823

File Name: macos_server_5_11.nasl

Version: 1.4

Type: local

Agent: macosx

Published: 2/25/2021

Updated: 6/3/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2020-9995

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x_server

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, MacOSX/Server/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 12/15/2020

Vulnerability Publication Date: 12/15/2020

Reference Information

CVE: CVE-2020-9995

APPLE-SA: APPLE-SA-2020-12-14-9, HT211932

IAVA: 2020-A-0576-S