Detections
Analytics

IBM Network Security Protection XGS Remote Code Execution (swg21690823) (credentialed check)

medium Nessus Plugin ID 80335

Language:

Synopsis

The remote appliance has an application that is affected by a code execution vulnerability.

Description

The firmware version installed on the remote IBM XGS appliance does not properly sanitize certain user-supplied inputs which can allow a remote, authenticated attacker to execute shell commands with the privileges of the 'www-data' user via a standard HTTP request.

Solution

Apply the relevant patch referenced in the vendor's advisory.

See Also

http://www-01.ibm.com/support/docview.wss?uid=swg21690823

Plugin Details

Severity: Medium

ID: 80335

File Name: ibm_xgs_swg21690823.nasl

Version: 1.5

Type: remote

Family: Misc.

Published: 1/2/2015

Updated: 11/25/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2014-6183

Vulnerability Information

CPE: cpe:/o:ibm:security_network_protection_firmware

Required KB Items: Host/IBM/XGS/version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/19/2014

Vulnerability Publication Date: 11/19/2014

Reference Information

CVE: CVE-2014-6183

BID: 71258