BASE < 1.4.4 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 5211

Synopsis

The remote host is running a PHP application that is vulnerable to multiple attack vectors.

Description

The remote host is running BASE, a web-based tool for analyzing alerts from one or more SNORT sensors. The version of BASE installed on the remote host is earlier than 1.4.4. Such versions are potentially affected by multiple issues :

- A SQL-injection flaw.

- A cross-site scripting vulnerability in 'base_local_rules.php'.

- A local file include vulnerability in 'base_local_rules.php'.

Solution

Upgrade to BASE version 1.4.4 or later.

See Also

http://www.nessus.org/u?86a77f0c

http://base.secureideas.net/news.php

Plugin Details

Severity: High

ID: 5211

Family: CGI

Published: 2009/10/27

Modified: 2018/09/16

Dependencies: 1442

Nessus ID: 42264

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2009/05/28

Vulnerability Publication Date: 2009/10/27

Reference Information

BID: 36830