Remi Perrot fixed several security related bugs in the bonsai, the Mozilla CVS query tool by web interface. Vulnerabilities include arbitrary code execution, cross-site scripting and access to configuration parameters. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0152 - Remote execution of arbitrary commands     as www-data
  - CAN-2003-0153 - Absolute path disclosure

  - CAN-2003-0154 - Cross site scripting attacks 

  - CAN-2003-0155 - Unauthenticated access to parameters     page

The remote host has the CGI suite 'Bonsai' installed. 

This suite is used to browse a CVS repository with a web browser. 

The remote version of this software is to be vulnerable to various flaws ranging from path disclosure and cross-site scripting to remote command execution. 

An attacker may exploit these flaws to temper with the integrity of the remote host.

It is possible that the remote web server contains one or more dangerous CGI scripts. 

Note that this plugin does not actually test for the underlying flaws but instead only searches for scripts with the same name as those with known vulnerabilities.

远程主机安装了 CGI 套件“Bonsai”。 

此套件用于通过 Web 浏览器浏览 CVS 存储库。 

此软件的远程版本容易受到从路径泄露和跨站脚本到远程命令执行的多个缺陷的影响。 

攻击者可能会利用这些缺陷破坏远程主机的完整性。

远程 Web 服务器可能包含一个或多个危险的 CGI 脚本。 

请注意，此插件并未实际测试潜在缺陷，而是仅搜索与具有已知漏洞的脚本同名的脚本。

The remote host has the CGI suite 'Bonsai' installed. This suite is used to navigate a CVS repository with a web browser. The remote Bonsai might be vulnerable to various flaws, including path disclosure, cross-site scripting and remote command execution.

The cvsview2.cgi script exists on this web server. Some versions of this file are vulnerable to a remote exploit.

The multidiff.cgi script exists on this web server.  Some versions of this file are vulnerable to a remote exploit.

ID	Name	Product	Family	Published	Updated	Severity
15102	Debian DSA-265-1 : bonsai - several vulnerabilities	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	high
11440	Mozilla Bonsai Mutiple Flaws (Auth Bypass, XSS, Cmd Exec, PD)	Nessus	CGI abuses	3/22/2003	1/19/2021	critical
11748	Multiple Dangerous CGI Script Detection	Nessus	CGI abuses	6/17/2003	12/7/2022	high
11440	Mozilla Bonsai 多个缺陷（身份验证绕过、XSS、Cmd Exec、PD）	Nessus	CGI abuses	3/22/2003	1/19/2021	critical
11748	多个危险 CGI 脚本检测	Nessus	CGI abuses	6/17/2003	12/7/2022	high
1584	Bonsai < 1.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/20/2004	3/6/2019	critical
1650	cvsview2.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/20/2004	3/6/2019	high
1652	multidiff.cgi Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/20/2004	3/6/2019	high

Detections

Analytics

Plugins Search

high

critical

high

critical

high

critical

high

high