Sawmill < 7.1.14 GET Request Query String XSS

Medium Nessus Network Monitor Plugin ID 3219


The remote host is vulnerable to a Cross-Site Scripting (XSS) attack.


The remote host is running Sawmill, a weblog analysis package. The version of Sawmill installed on the remote host suffers from a cross-site scripting flaw because its standalone web server treats an arbitrary query string appended to a GET request as a configuration command and fails to sanitize it before using it in an error page. An unauthenticated attacker may be able to exploit this issue to steal authentication information of users of the affected application.


Upgrade to version 7.1.14 or higher or use Sawmill in CGI mode.

See Also

Plugin Details

Severity: Medium

ID: 3219

File Name: 3219.prm

Family: Web Servers

Published: 2005/09/09

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 19681

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C


Base Score: 5.3

Temporal Score: 5.1


Temporal Vector: CVSS3#E:H/RL:O/RC:X

Reference Information

CVE: CVE-2005-2950

BID: 14789