Remi Perrot fixed several security related bugs in the bonsai, the Mozilla CVS query tool by web interface. Vulnerabilities include arbitrary code execution, cross-site scripting and access to configuration parameters. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0152 - Remote execution of arbitrary commands     as www-data
  - CAN-2003-0153 - Absolute path disclosure

  - CAN-2003-0154 - Cross site scripting attacks 

  - CAN-2003-0155 - Unauthenticated access to parameters     page

The remote host has the CGI suite 'Bonsai' installed. 

This suite is used to browse a CVS repository with a web browser. 

The remote version of this software is to be vulnerable to various flaws ranging from path disclosure and cross-site scripting to remote command execution. 

An attacker may exploit these flaws to temper with the integrity of the remote host.

It is possible that the remote web server contains one or more dangerous CGI scripts. 

Note that this plugin does not actually test for the underlying flaws but instead only searches for scripts with the same name as those with known vulnerabilities.

The remote host has the CGI suite 'Bonsai' installed. This suite is used to navigate a CVS repository with a web browser. The remote Bonsai might be vulnerable to various flaws, including path disclosure, cross-site scripting and remote command execution.

The cvsview2.cgi script exists on this web server. Some versions of this file are vulnerable to a remote exploit.

The multidiff.cgi script exists on this web server.  Some versions of this file are vulnerable to a remote exploit.

ID	Name	Product	Family	Published	Updated	Severity
15102	Debian DSA-265-1 : bonsai - several vulnerabilities	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	high
11440	Mozilla Bonsai Mutiple Flaws (Auth Bypass, XSS, Cmd Exec, PD)	Nessus	CGI abuses	3/22/2003	1/19/2021	critical
11748	Multiple Dangerous CGI Script Detection	Nessus	CGI abuses	6/17/2003	12/7/2022	high
1584	Bonsai < 1.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/20/2004	3/6/2019	critical
1650	cvsview2.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/20/2004	3/6/2019	high
1652	multidiff.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/20/2004	3/6/2019	high

Detections

Analytics

Plugins Search

high

critical

high

critical

high

high