Halon Security Router < 3.2r2 Multiple Vulnerabilities

medium Nessus Plugin ID 77115

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version, the instance of Halon Security Router running on the remote host is affected by multiple vulnerabilities :

- Multiple reflected cross-site scripting vulnerabilities exist in the web interface due to a failure to sanitize user-supplied input.

- Multiple cross-site request forgery vulnerabilities exist in the web interface due to a lack of XSRF tokens in forms.

- Multiple open redirect vulnerabilities exist in the web interface due to a failure to sanitize the user-supplied 'uri' parameter in multiple locations.

Solution

Upgrade to version 3.2r2 or later.

Plugin Details

Severity: Medium

ID: 77115

File Name: halon_sr_3_2_r2.nasl

Version: 1.6

Type: remote

Family: CGI abuses

Published: 8/11/2014

Updated: 1/19/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:halon:security_router

Required KB Items: installed_sw/Halon Security Router

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/3/2014

Vulnerability Publication Date: 4/7/2014

Reference Information

BID: 66707

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990