LiveZilla < 5.1.2.1 Multiple Vulnerabilities

high Nessus Plugin ID 71522

Synopsis

The remote web server contains a PHP application that is affected by multiple vulnerabilities.

Description

The version of LiveZilla hosted on the remote web server is affected by multiple vulnerabilities :

- The application is affected by multiple cross-site scripting (XSS) vulnerabilities because it fails to properly sanitize user-supplied input. Note that CVE-2013-7003 was reportedly fixed in version 5.1.2.0.
(CVE-2013-7003, CVE-2013-7032)

- The application insecurely stores credentials that are accessible via JavaScript. An attacker can gain access to these credentials by exploiting a cross-site scripting vulnerability. Note that the vendor update partially fixes the issue by storing the credentials as MD5 hashes. (CVE-2013-7033)

- The application is affected by a PHP object injection vulnerability because it fails to properly sanitize user-supplied input to the 'setCookieValue()' function of the '_lib/functions.global.inc.php' script.
(CVE-2013-7034)

Solution

Upgrade to LiveZilla version 5.1.2.1 or later.

See Also

http://www.nessus.org/u?86f60d46

http://www.livezilla.net/board/index.php?/topic/163-livezilla-changelog/

Plugin Details

Severity: High

ID: 71522

File Name: livezilla_5_1_2_1.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 12/18/2013

Updated: 5/28/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2013-7034

Vulnerability Information

CPE: cpe:/a:livezilla:livezilla

Required KB Items: www/PHP, installed_sw/LiveZilla

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/10/2013

Vulnerability Publication Date: 12/10/2013

Reference Information

CVE: CVE-2013-7003, CVE-2013-7032, CVE-2013-7033, CVE-2013-7034

BID: 64202, 64376, 64378, 64383

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990