Detections
Analytics
Cerberus FTP Server < 5.0.6.0 Multiple XSS
medium Nessus Plugin ID 63560
Language:
Synopsis
The FTP server installed on the remote Windows host has multiple cross-site scripting vulnerabilities.Description
The version of Cerberus FTP server on the remote host is earlier than 5.0.6.0. As such, it is potentially affected by the following cross- site scripting vulnerabilities :- The user-supplied input for fields under administration 'Messages' tab are not validated before being returned to the user.
- The user-supplied input to the 'USER' FTP command is not validated before display in the administration logging page.
A remote attacker could exploit these by tricking a user into requesting a maliciously crafted URL, resulting in the execution of arbitrary script code.
Solution
Upgrade to Cerberus FTP server 5.0.6.0 or later.See Also
Plugin Details
Severity: Medium
ID: 63560
File Name: cerberus_ftp_5_0_6.nasl
Version: 1.10
Type: local
Agent: windows
Family: FTP
Published: 1/16/2013
Updated: 10/16/2020
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2012-6339
Vulnerability Information
CPE: cpe:/a:cerberusftp:ftp_server
Required KB Items: SMB/CerberusFTP/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 12/11/2012
Vulnerability Publication Date: 12/11/2012
Reference Information
CVE: CVE-2012-6339
BID: 56906