Detections
Analytics
FireStats < 1.6.2 Multiple Vulnerabilities
high Nessus Plugin ID 39621
Language:
Synopsis
A web application on the remote host is affected by multiple vulnerabilities.Description
According to its version number, the install of FireStats running on the remote host is affected by multiple vulnerabilities :- A remote file include vulnerability in the 'fs_javascript' parameter of 'firestats-wordpress.php'.
(CVE-2009-2143)
- An unspecified SQL injection vulnerability.
(CVE-2009-2144)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to FireStats 1.6.2-stable or later.See Also
Plugin Details
Severity: High
ID: 39621
File Name: firestats_1_6_2.nasl
Version: 1.17
Type: remote
Family: CGI abuses
Published: 7/7/2009
Updated: 6/4/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:edgewall:firestats
Required KB Items: www/PHP, installed_sw/FireStats
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/13/2009
Vulnerability Publication Date: 6/13/2009
Reference Information
CVE: CVE-2009-2143, CVE-2009-2144