Detections
Analytics
CentOS 9 : toolbox-0.0.99.4-5.el9
critical Nessus Plugin ID 193938
Language:
Synopsis
The remote CentOS host is missing one or more security updates for toolbox.Description
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.4-5.el9 build changelog.- Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)
- Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)
- Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. (CVE-2023-29400)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the CentOS 9 Stream toolbox package.See Also
https://kojihub.stream.centos.org/koji/buildinfo?buildID=36385
Plugin Details
Severity: Critical
ID: 193938
File Name: centos9_toolbox-0_0_99_4-5_36385.nasl
Version: 1.0
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 4/26/2024
Updated: 4/26/2024
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-24540
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:centos:centos:toolbox, p-cpe:/a:centos:centos:toolbox-tests, cpe:/a:centos:centos:9
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/CentOS/release, Host/CentOS/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 8/11/2023
Vulnerability Publication Date: 5/4/2023