CVE-2009-4647

Опубликовано: 19 фев. 2010

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs.

Ссылки

http://secunia.com/advisories/38522
Vendor Advisory
http://www.portcullis-security.com/339.php
Exploit
http://www.securityfocus.com/bid/38176
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/56247
http://secunia.com/advisories/38522
Vendor Advisory
http://www.portcullis-security.com/339.php
Exploit
http://www.securityfocus.com/bid/38176
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/56247

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_135:*:*:*:*:*:*:*

cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_178:*:*:*:*:*:*:*

cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_189:*:*:*:*:*:*:*

cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_259:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00285

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-994j-rh9r-7g2v

github

почти 4 года назад