Sawmill < 7.1.14 GET Request Query String XSS

Medium Nessus Network Monitor Plugin ID 3219

Synopsis

The remote host is vulnerable to a Cross-Site Scripting (XSS) attack.

Description

The remote host is running Sawmill, a weblog analysis package. The version of Sawmill installed on the remote host suffers from a cross-site scripting flaw because its standalone web server treats an arbitrary query string appended to a GET request as a configuration command and fails to sanitize it before using it in an error page. An unauthenticated attacker may be able to exploit this issue to steal authentication information of users of the affected application.

Solution

Upgrade to version 7.1.14 or higher or use Sawmill in CGI mode.

See Also

http://archives.neohapsis.com/archives/bugtraq/2005-09/0114.html

http://www.nta-monitor.com/news/xss/sawmill/index.htm

Plugin Details

Severity: Medium

ID: 3219

File Name: 3219.prm

Family: Web Servers

Published: 2005/09/09

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 19681

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:H/RL:O/RC:X

Reference Information

CVE: CVE-2005-2950

BID: 14789