medium4.3Public exploit code
CVE-2012-4923
Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Endian Firewall 2.4 - 'dansguardian.cgi?addrule' Cross-Site Scripting2012-02-27 · remote · hardware · Verified
- Endian Firewall 2.4 - 'dnat.cgi?createrule' Cross-Site Scripting2012-02-27 · remote · hardware · Verified
- Endian Firewall 2.4 - 'openvpn_users.cgi?PATH_INFO' Cross-Site Scripting2012-02-27 · remote · hardware · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule parameter to dansguardian.cgi, or (3) PATH_INFO to openvpn_users.cgi.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Endian | Firewall | Version 2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/files/109942/Endian-UTM-Firewall-2.4.x-Cross-Site-Scripting.html
- http://www.securityfocus.com/bid/52076
- http://www.vulnerability-lab.com/get_content.php?id=436
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73330
- http://packetstormsecurity.org/files/109942/Endian-UTM-Firewall-2.4.x-Cross-Site-Scripting.html
- http://www.securityfocus.com/bid/52076
- http://www.vulnerability-lab.com/get_content.php?id=436
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73330