medium4.3Public exploit code
CVE-2009-1593
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attac…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Profense 2.2.20/2.4.2 - Web Application Firewall Security Bypass2009-05-20 · webapps · php · Verified
Impact
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Armorlogic | Profense Web Application Firewall | through 2.2.21 Version 2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
- http://www.securityfocus.com/archive/1/503649/100/0/threaded
- http://www.securityfocus.com/bid/35053
- http://www.webappsec.org/lists/websecurity/archive/2009-05/msg00040.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50663
- http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
- http://www.securityfocus.com/archive/1/503649/100/0/threaded
- http://www.securityfocus.com/bid/35053
- http://www.webappsec.org/lists/websecurity/archive/2009-05/msg00040.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50663