Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities found for Firewall Analyzer by AlgoSec
CVE-2025-12381 (GCVE-0-2025-12381)
Vulnerability from cvelistv5 – Published: 2025-12-09 13:41 – Updated: 2025-12-09 14:26
VLAI
Title
Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer
Summary
Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation, Parameter Injection.
A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.
This issue affects Firewall Analyzer: A33.0, A33.10.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AlgoSec | Firewall Analyzer |
Affected:
A33.0 (up to build 320)
Affected: A33.10 (up to build 220) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-09T14:25:52.884477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-09T14:26:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"64 bit"
],
"product": "Firewall Analyzer",
"vendor": "AlgoSec",
"versions": [
{
"status": "affected",
"version": "A33.0 (up to build 320)"
},
{
"status": "affected",
"version": "A33.10 (up to build 220)"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:64_bit:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:64_bit:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Charlie Lindholm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows\u0026nbsp;Privilege Escalation, Parameter Injection.\u003cbr\u003e\u003cbr\u003eA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.\u0026nbsp;\u003cbr\u003e\u003cp\u003eThis issue affects Firewall Analyzer: A33.0, A33.10.\u003c/p\u003e"
}
],
"value": "Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows\u00a0Privilege Escalation, Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.\u00a0\nThis issue affects Firewall Analyzer: A33.0, A33.10."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
},
{
"capecId": "CAPEC-137",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-137 Parameter Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-09T13:41:53.393Z",
"orgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"shortName": "AlgoSec"
},
"references": [
{
"url": "https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12381.htm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade ASMS suite to A33.0\u0026nbsp;(build 330 and above), A33.10 (build 230 and above).\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal.algosec.com/en/downloads/hotfix_releases\"\u003ehttps://portal.algosec.com/en/downloads/hotfix_releases\u003c/a\u003e\u003cbr\u003e"
}
],
"value": "Upgrade ASMS suite to A33.0\u00a0(build 330 and above), A33.10 (build 230 and above).\n https://portal.algosec.com/en/downloads/hotfix_releases"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"assignerShortName": "AlgoSec",
"cveId": "CVE-2025-12381",
"datePublished": "2025-12-09T13:41:53.393Z",
"dateReserved": "2025-10-28T09:05:51.106Z",
"dateUpdated": "2025-12-09T14:26:01.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12382 (GCVE-0-2025-12382)
Vulnerability from cvelistv5 – Published: 2025-11-12 09:37 – Updated: 2025-11-13 10:48
VLAI
Title
Path Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer
Summary
Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AlgoSec | Firewall Analyzer |
Affected:
A33.0 (up to build 320)
Affected: A33.10 (up to build 210) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T14:17:21.499005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T14:18:02.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"64 bit"
],
"product": "Firewall Analyzer",
"vendor": "AlgoSec",
"versions": [
{
"status": "affected",
"version": "A33.0 (up to build 320)"
},
{
"status": "affected",
"version": "A33.10 (up to build 210)"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:64_bit:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:64_bit:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Charlie Lindholm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname \u0027Path Traversal\u0027) vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210)."
}
],
"value": "Improper Limitation of a Pathname \u0027Path Traversal\u0027) vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210)."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T10:48:50.053Z",
"orgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"shortName": "AlgoSec"
},
"references": [
{
"url": "https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12382.htm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade ASMS suite to A33.0 (330 and above), A33.10 (220 and above).\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal.algosec.com/en/downloads/hotfix_releases\"\u003ehttps://portal.algosec.com/en/downloads/hotfix_releases\u003c/a\u003e\u003cbr\u003e\n\n\u003cbr\u003e"
}
],
"value": "Upgrade ASMS suite to A33.0 (330 and above), A33.10 (220 and above).\n https://portal.algosec.com/en/downloads/hotfix_releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"assignerShortName": "AlgoSec",
"cveId": "CVE-2025-12382",
"datePublished": "2025-11-12T09:37:01.568Z",
"dateReserved": "2025-10-28T09:05:58.212Z",
"dateUpdated": "2025-11-13T10:48:50.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12381 (GCVE-0-2025-12381)
Vulnerability from nvd – Published: 2025-12-09 13:41 – Updated: 2025-12-09 14:26
VLAI
Title
Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer
Summary
Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation, Parameter Injection.
A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.
This issue affects Firewall Analyzer: A33.0, A33.10.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AlgoSec | Firewall Analyzer |
Affected:
A33.0 (up to build 320)
Affected: A33.10 (up to build 220) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-09T14:25:52.884477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-09T14:26:01.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"64 bit"
],
"product": "Firewall Analyzer",
"vendor": "AlgoSec",
"versions": [
{
"status": "affected",
"version": "A33.0 (up to build 320)"
},
{
"status": "affected",
"version": "A33.10 (up to build 220)"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:64_bit:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:64_bit:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Charlie Lindholm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows\u0026nbsp;Privilege Escalation, Parameter Injection.\u003cbr\u003e\u003cbr\u003eA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.\u0026nbsp;\u003cbr\u003e\u003cp\u003eThis issue affects Firewall Analyzer: A33.0, A33.10.\u003c/p\u003e"
}
],
"value": "Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows\u00a0Privilege Escalation, Parameter Injection.\n\nA local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.\u00a0\nThis issue affects Firewall Analyzer: A33.0, A33.10."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
},
{
"capecId": "CAPEC-137",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-137 Parameter Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-09T13:41:53.393Z",
"orgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"shortName": "AlgoSec"
},
"references": [
{
"url": "https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12381.htm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade ASMS suite to A33.0\u0026nbsp;(build 330 and above), A33.10 (build 230 and above).\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal.algosec.com/en/downloads/hotfix_releases\"\u003ehttps://portal.algosec.com/en/downloads/hotfix_releases\u003c/a\u003e\u003cbr\u003e"
}
],
"value": "Upgrade ASMS suite to A33.0\u00a0(build 330 and above), A33.10 (build 230 and above).\n https://portal.algosec.com/en/downloads/hotfix_releases"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"assignerShortName": "AlgoSec",
"cveId": "CVE-2025-12381",
"datePublished": "2025-12-09T13:41:53.393Z",
"dateReserved": "2025-10-28T09:05:51.106Z",
"dateUpdated": "2025-12-09T14:26:01.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12382 (GCVE-0-2025-12382)
Vulnerability from nvd – Published: 2025-11-12 09:37 – Updated: 2025-11-13 10:48
VLAI
Title
Path Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer
Summary
Improper Limitation of a Pathname 'Path Traversal') vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AlgoSec | Firewall Analyzer |
Affected:
A33.0 (up to build 320)
Affected: A33.10 (up to build 210) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T14:17:21.499005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T14:18:02.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"64 bit"
],
"product": "Firewall Analyzer",
"vendor": "AlgoSec",
"versions": [
{
"status": "affected",
"version": "A33.0 (up to build 320)"
},
{
"status": "affected",
"version": "A33.10 (up to build 210)"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.0:*:64_bit:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:algosec:firewall_analyzer:a33.10:*:64_bit:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Charlie Lindholm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname \u0027Path Traversal\u0027) vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210)."
}
],
"value": "Improper Limitation of a Pathname \u0027Path Traversal\u0027) vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210)."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T10:48:50.053Z",
"orgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"shortName": "AlgoSec"
},
"references": [
{
"url": "https://techdocs.algosec.com/en/cves/Content/tech-notes/cves/cve-2025-12382.htm"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade ASMS suite to A33.0 (330 and above), A33.10 (220 and above).\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal.algosec.com/en/downloads/hotfix_releases\"\u003ehttps://portal.algosec.com/en/downloads/hotfix_releases\u003c/a\u003e\u003cbr\u003e\n\n\u003cbr\u003e"
}
],
"value": "Upgrade ASMS suite to A33.0 (330 and above), A33.10 (220 and above).\n https://portal.algosec.com/en/downloads/hotfix_releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path Traversal Allows Remote Code Execution in AlgoSec Firewall Analyzer",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca5f073f-8266-4d43-b3e3-6eb0bb18a738",
"assignerShortName": "AlgoSec",
"cveId": "CVE-2025-12382",
"datePublished": "2025-11-12T09:37:01.568Z",
"dateReserved": "2025-10-28T09:05:58.212Z",
"dateUpdated": "2025-11-13T10:48:50.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201401-0109
Vulnerability from variot - Updated: 2023-12-18 13:53Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. AlgoSec Firewall Analyzer (AFA) is a set of firewall analysis solutions from AlgoSec Company in the United States. The solution supports automatic detection of security loopholes in firewall policies. A cross-site scripting vulnerability exists in the afa/php/Login.php script in version 6.1-b86 of AFA
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0109",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "firewall analyzer",
"scope": "eq",
"trust": 1.6,
"vendor": "algosec",
"version": "6.1"
},
{
"model": "firewall analyzer",
"scope": "eq",
"trust": 0.8,
"vendor": "algosec",
"version": "6.1-b86"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:algosec:firewall_analyzer:6.1:b86:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-5092"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Asheesh kumar Mani Tripathi, Asheesh Anaconda",
"sources": [
{
"db": "BID",
"id": "61733"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
],
"trust": 0.9
},
"cve": "CVE-2013-5092",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2013-5092",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-65094",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-5092",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201308-171",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-65094",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2013-5092",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. \nAlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. AlgoSec Firewall Analyzer (AFA) is a set of firewall analysis solutions from AlgoSec Company in the United States. The solution supports automatic detection of security loopholes in firewall policies. A cross-site scripting vulnerability exists in the afa/php/Login.php script in version 6.1-b86 of AFA",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "BID",
"id": "61733"
},
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-65094",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=38692",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-5092",
"trust": 2.9
},
{
"db": "BID",
"id": "61733",
"trust": 2.9
},
{
"db": "OSVDB",
"id": "96806",
"trust": 2.6
},
{
"db": "PACKETSTORM",
"id": "122737",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171",
"trust": 0.7
},
{
"db": "XF",
"id": "86336",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "38692",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-65094",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2013-5092",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"db": "BID",
"id": "61733"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"id": "VAR-201401-0109",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:53:24.327000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AlgoSec Firewall Analyzer",
"trust": 0.8,
"url": "http://www.algosec.com/en/products_solutions/products/firewall_analyzer"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://www.osvdb.org/96806"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/61733"
},
{
"trust": 1.8,
"url": "http://packetstormsecurity.com/files/122737/algosec-xss.txt"
},
{
"trust": 1.2,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86336"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5092"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5092"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/61733/info"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/86336"
},
{
"trust": 0.3,
"url": "http://www.algosec.com/en/products/firewall_analyzer"
},
{
"trust": 0.3,
"url": "https://portal.algosec.com/en/downloads/software_releases_n_hotfixes/firewall_analyzer_releases_n_hotfixes "
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/38692/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"db": "BID",
"id": "61733"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-65094"
},
{
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"db": "BID",
"id": "61733"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-29T00:00:00",
"db": "VULHUB",
"id": "VHN-65094"
},
{
"date": "2014-01-29T00:00:00",
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"date": "2013-08-07T00:00:00",
"db": "BID",
"id": "61733"
},
{
"date": "2014-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"date": "2014-01-29T18:55:26.887000",
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"date": "2013-08-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-65094"
},
{
"date": "2017-08-29T00:00:00",
"db": "VULMON",
"id": "CVE-2013-5092"
},
{
"date": "2015-03-19T08:42:00",
"db": "BID",
"id": "61733"
},
{
"date": "2014-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005948"
},
{
"date": "2017-08-29T01:33:42.310000",
"db": "NVD",
"id": "CVE-2013-5092"
},
{
"date": "2014-02-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AlgoSec Firewall Analyzer of afa/php/Login.php Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005948"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201308-171"
}
],
"trust": 0.6
}
}
VAR-201401-0573
Vulnerability from variot - Updated: 2023-12-18 12:08Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter. AlgoSec Firewall Analyzer (AFA) is a set of firewall analysis solutions from AlgoSec Company in the United States. The solution supports automatic detection of security loopholes in firewall policies
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0573",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "firewall analyzer",
"scope": "eq",
"trust": 2.7,
"vendor": "algosec",
"version": "6.4"
}
],
"sources": [
{
"db": "BID",
"id": "80100"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:algosec:firewall_analyzer:6.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7318"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "80100"
}
],
"trust": 0.3
},
"cve": "CVE-2013-7318",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2013-7318",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-67320",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-7318",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-590",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-67320",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-67320"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter. AlgoSec Firewall Analyzer (AFA) is a set of firewall analysis solutions from AlgoSec Company in the United States. The solution supports automatic detection of security loopholes in firewall policies",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "BID",
"id": "80100"
},
{
"db": "VULHUB",
"id": "VHN-67320"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-7318",
"trust": 2.8
},
{
"db": "OSVDB",
"id": "96807",
"trust": 2.5
},
{
"db": "PACKETSTORM",
"id": "122899",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590",
"trust": 0.7
},
{
"db": "BID",
"id": "80100",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-67320",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-67320"
},
{
"db": "BID",
"id": "80100"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"id": "VAR-201401-0573",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-67320"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:08:53.097000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "AlgoSec Firewall Analyzer",
"trust": 0.8,
"url": "http://www.algosec.com/en/products_solutions/products/firewall_analyzer"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-67320"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.osvdb.org/96807"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/122899/algosec64-xss.txt"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7318"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7318"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-67320"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-67320"
},
{
"db": "BID",
"id": "80100"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-29T00:00:00",
"db": "VULHUB",
"id": "VHN-67320"
},
{
"date": "2014-01-29T00:00:00",
"db": "BID",
"id": "80100"
},
{
"date": "2014-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"date": "2014-01-29T18:55:26.967000",
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-08-06T00:00:00",
"db": "VULHUB",
"id": "VHN-67320"
},
{
"date": "2014-01-29T00:00:00",
"db": "BID",
"id": "80100"
},
{
"date": "2014-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005949"
},
{
"date": "2014-08-06T13:04:03.037000",
"db": "NVD",
"id": "CVE-2013-7318"
},
{
"date": "2014-02-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AlgoSec Firewall Analyzer of BusinessFlow/login Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005949"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-590"
}
],
"trust": 0.6
}
}