bonsai Mozilla CVS query tool allows remote attackers to gain access to the parameters page without authentication.

Remi Perrot fixed several security related bugs in the bonsai, the Mozilla CVS query tool by web interface. Vulnerabilities include arbitrary code execution, cross-site scripting and access to configuration parameters. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0152 - Remote execution of arbitrary commands     as www-data
  - CAN-2003-0153 - Absolute path disclosure

  - CAN-2003-0154 - Cross site scripting attacks 

  - CAN-2003-0155 - Unauthenticated access to parameters     page

The multidiff.cgi script exists on this web server.  Some versions of this file are vulnerable to a remote exploit.

The cvsview2.cgi script exists on this web server. Some versions of this file are vulnerable to a remote exploit.

The remote host has the CGI suite 'Bonsai' installed. This suite is used to navigate a CVS repository with a web browser. The remote Bonsai might be vulnerable to various flaws, including path disclosure, cross-site scripting and remote command execution.

The remote host has the CGI suite 'Bonsai' installed. 

This suite is used to browse a CVS repository with a web browser. 

The remote version of this software is to be vulnerable to various flaws ranging from path disclosure and cross-site scripting to remote command execution. 

An attacker may exploit these flaws to temper with the integrity of the remote host.

ID	Name	Product	Family	Severity
15102	Debian DSA-265-1 : bonsai - several vulnerabilities	Nessus	Debian Local Security Checks	high
1652	multidiff.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
1650	cvsview2.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
1584	Bonsai < 1.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
11440	Mozilla Bonsai Mutiple Flaws (Auth Bypass, XSS, Cmd Exec, PD)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2003-0155

critical

Tenable Plugins

high

high

high

critical

critical