NewStart CGSL CORE 5.05 / MAIN 5.05 : ipa Multiple Vulnerabilities (NS-SA-2021-0171)

medium Nessus Plugin ID 154495
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.


The remote NewStart CGSL host is affected by multiple vulnerabilities.


The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ipa packages installed that are affected by multiple vulnerabilities:

- jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

- In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. (CVE-2016-10735)

- In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. (CVE-2018-14040)

- In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. (CVE-2018-14042)

- In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. (CVE-2018-20676)

- In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. (CVE-2018-20677)

- jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
__proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

- In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. (CVE-2019-8331)

- In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. (CVE-2020-11022)

- A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability. (CVE-2020-1722)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Upgrade the vulnerable CGSL ipa packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

See Also

Plugin Details

Severity: Medium

ID: 154495

File Name: newstart_cgsl_NS-SA-2021-0171_ipa.nasl

Version: 1.3

Type: local

Published: 10/27/2021

Updated: 10/28/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2020-11022


Risk Factor: Medium

Score: 5.7


Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: E:POC/RL:OF/RC:C


Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_core:ipa-client, p-cpe:/a:zte:cgsl_core:ipa-client-common, p-cpe:/a:zte:cgsl_core:ipa-common, p-cpe:/a:zte:cgsl_core:ipa-python-compat, p-cpe:/a:zte:cgsl_core:ipa-server, p-cpe:/a:zte:cgsl_core:ipa-server-common, p-cpe:/a:zte:cgsl_core:ipa-server-dns, p-cpe:/a:zte:cgsl_core:ipa-server-trust-ad, p-cpe:/a:zte:cgsl_core:python2-ipaclient, p-cpe:/a:zte:cgsl_core:python2-ipalib, p-cpe:/a:zte:cgsl_core:python2-ipaserver, p-cpe:/a:zte:cgsl_main:ipa-client, p-cpe:/a:zte:cgsl_main:ipa-client-common, p-cpe:/a:zte:cgsl_main:ipa-common, p-cpe:/a:zte:cgsl_main:ipa-python-compat, p-cpe:/a:zte:cgsl_main:ipa-server, p-cpe:/a:zte:cgsl_main:ipa-server-common, p-cpe:/a:zte:cgsl_main:ipa-server-dns, p-cpe:/a:zte:cgsl_main:ipa-server-trust-ad, p-cpe:/a:zte:cgsl_main:python2-ipaclient, p-cpe:/a:zte:cgsl_main:python2-ipalib, p-cpe:/a:zte:cgsl_main:python2-ipaserver, cpe:/o:zte:cgsl_core:5, cpe:/o:zte:cgsl_main:5

Required KB Items: Host/local_checks_enabled, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2021

Vulnerability Publication Date: 1/18/2018

Reference Information

CVE: CVE-2015-9251, CVE-2016-10735, CVE-2018-14040, CVE-2018-14042, CVE-2018-20676, CVE-2018-20677, CVE-2019-8331, CVE-2019-11358, CVE-2020-1722, CVE-2020-11022

IAVA: 2018-A-0336-S, 2019-A-0256-S, 2019-A-0021-S, 2019-A-0020-S, 2019-A-0128, 2020-A-0017, 2020-A-0150, 2019-A-0384, 2021-A-0032, 2020-A-0324, 2021-A-0035-S, 2021-A-0196, 2021-A-0480

IAVB: 2020-B-0030