GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4609-1 advisory.

    Fabian Henneke discovered that GOsa incorrectly handled client cookies. An authenticated user could     exploit this with a crafted cookie to perform file deletions in the context of the user account that runs     the web server. (CVE-2019-14466)

    It was discovered that GOsa incorrectly handled user access control. A remote attacker could use this     issue to log into any account with a username containing the word success. (CVE-2019-11187)

    Fabian Henneke discovered that GOsa was vulnerable to cross-site scripting attacks via the change password     form. A remote attacker could use this flaw to run arbitrary web scripts. (CVE-2018-1000528)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fabian Henneke discovered a cross-site scripting vulnerability in the password change form of GOsa, a web-based LDAP administration program.

For Debian 8 'Jessie', this problem has been fixed in version 2.7.4+reloaded2-1+deb8u3.

We recommend that you upgrade your gosa packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fabian Henneke discovered a cross-site scripting vulnerability in the password change form of GOsa, a web-based LDAP administration program.

ID	Name	Product	Family	Severity
142026	Ubuntu 16.04 LTS : GOsa vulnerabilities (USN-4609-1)	Nessus	Ubuntu Local Security Checks	critical
111221	Debian DLA-1436-1 : gosa security update	Nessus	Debian Local Security Checks	medium
110911	Debian DSA-4239-1 : gosa - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-1000528

medium

Tenable Plugins

critical

medium

medium