VAR-200902-0031
Vulnerability from variot - Updated: 2023-12-18 13:25Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a deny_log manage action. Profense is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to alter the settings on affected devices. This may lead to further network-based attacks. Other attacks are also possible. Profense 2.6.2 is vulnerable; other versions may also be affected. Profense Web Application Firewal is a website firewall. ----------------------------------------------------------------------
Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list?
Click here to learn more: http://secunia.com/advisories/business_solutions/
TITLE: Profense Web Application Firewall Cross-Site Scripting and Cross-Site Request Forgery
SECUNIA ADVISORY ID: SA33739
VERIFY ADVISORY: http://secunia.com/advisories/33739/
CRITICAL: Less critical
IMPACT: Cross Site Scripting
WHERE:
From remote
SOFTWARE: Profense Web Application Firewall 2.x http://secunia.com/advisories/product/21280/
DESCRIPTION: Michael Brooks has discovered some vulnerabilities in Profense Web Application Firewall, which can be exploited by malicious people to conduct cross-site scripting and cross-site request forgery attacks.
1) Input passed via the "proxy" parameter in proxy.html is not properly sanitised before being returned to the user.
2) The application allows users to perform certain actions via HTTP requests without performing any validity check to verify the request. This can be exploited to perform certain actions, e.g. to shutdown the system, by enticing a logged-in administrator to visit a malicious web site.
The vulnerability is reported in version 2.6.2 and confirmed in version 2.6.3.
SOLUTION: Do not follow untrusted links and do not visit untrusted web sites while being logged-in to the web-based management interface.
PROVIDED AND/OR DISCOVERED BY: Michael Brooks
ORIGINAL ADVISORY: http://milw0rm.com/exploits/7919
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200902-0031",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "profense web application firewall",
"scope": "eq",
"trust": 1.6,
"vendor": "armorlogic",
"version": "2.6.3"
},
{
"model": "profense web application firewall",
"scope": "eq",
"trust": 1.6,
"vendor": "armorlogic",
"version": "2.6.2"
},
{
"model": "profense web application firewall",
"scope": "eq",
"trust": 0.8,
"vendor": "armorlogic",
"version": "2.6.2 and 2.6.3"
},
{
"model": "profense",
"scope": "eq",
"trust": 0.3,
"vendor": "armorlogic",
"version": "2.6.2"
},
{
"model": "profense",
"scope": "ne",
"trust": 0.3,
"vendor": "armorlogic",
"version": "2.6.4"
}
],
"sources": [
{
"db": "BID",
"id": "33523"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:armorlogic:profense_web_application_firewall:2.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:armorlogic:profense_web_application_firewall:2.6.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0467"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael Brooks",
"sources": [
{
"db": "BID",
"id": "33523"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
],
"trust": 0.9
},
"cve": "CVE-2009-0467",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2009-0467",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-37913",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-0467",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200902-234",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-37913",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in proxy.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allows remote attackers to inject arbitrary web script or HTML via the proxy parameter in a deny_log manage action. Profense is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. \nAn attacker can exploit the cross-site request forgery issue to alter the settings on affected devices. This may lead to further network-based attacks. Other attacks are also possible. \nProfense 2.6.2 is vulnerable; other versions may also be affected. Profense Web Application Firewal is a website firewall. ----------------------------------------------------------------------\n\nDid you know that a change in our assessment rating, exploit code\navailability, or if an updated patch is released by the vendor, is\nnot part of this mailing-list?\n\nClick here to learn more:\nhttp://secunia.com/advisories/business_solutions/\n\n----------------------------------------------------------------------\n\nTITLE:\nProfense Web Application Firewall Cross-Site Scripting and Cross-Site\nRequest Forgery\n\nSECUNIA ADVISORY ID:\nSA33739\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/33739/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nCross Site Scripting\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nProfense Web Application Firewall 2.x\nhttp://secunia.com/advisories/product/21280/\n\nDESCRIPTION:\nMichael Brooks has discovered some vulnerabilities in Profense Web\nApplication Firewall, which can be exploited by malicious people to\nconduct cross-site scripting and cross-site request forgery attacks. \n\n1) Input passed via the \"proxy\" parameter in proxy.html is not\nproperly sanitised before being returned to the user. \n\n2) The application allows users to perform certain actions via HTTP\nrequests without performing any validity check to verify the request. \nThis can be exploited to perform certain actions, e.g. to shutdown the\nsystem, by enticing a logged-in administrator to visit a malicious web\nsite. \n\nThe vulnerability is reported in version 2.6.2 and confirmed in\nversion 2.6.3. \n\nSOLUTION:\nDo not follow untrusted links and do not visit untrusted web sites\nwhile being logged-in to the web-based management interface. \n\nPROVIDED AND/OR DISCOVERED BY:\nMichael Brooks\n\nORIGINAL ADVISORY:\nhttp://milw0rm.com/exploits/7919\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "BID",
"id": "33523"
},
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "PACKETSTORM",
"id": "74477"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-37913",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-0467",
"trust": 2.5
},
{
"db": "BID",
"id": "33523",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "33739",
"trust": 1.9
},
{
"db": "EXPLOIT-DB",
"id": "7919",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "51659",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237",
"trust": 0.8
},
{
"db": "MILW0RM",
"id": "7919",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-66247",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-37913",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "74477",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "BID",
"id": "33523"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "PACKETSTORM",
"id": "74477"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"id": "VAR-200902-0031",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:25:30.189000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.armorlogic.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/33523"
},
{
"trust": 1.7,
"url": "http://osvdb.org/51659"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/33739"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/7919"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0467"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-0467"
},
{
"trust": 0.6,
"url": "http://www.milw0rm.com/exploits/7919"
},
{
"trust": 0.3,
"url": "http://www.armorlogic.com/index.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33739/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://milw0rm.com/exploits/7919"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/product/21280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "BID",
"id": "33523"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "PACKETSTORM",
"id": "74477"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-37913"
},
{
"db": "BID",
"id": "33523"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"db": "PACKETSTORM",
"id": "74477"
},
{
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-02-10T00:00:00",
"db": "VULHUB",
"id": "VHN-37913"
},
{
"date": "2009-01-29T00:00:00",
"db": "BID",
"id": "33523"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"date": "2009-01-30T11:11:49",
"db": "PACKETSTORM",
"id": "74477"
},
{
"date": "2009-02-10T07:00:24.670000",
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"date": "2009-02-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-29T00:00:00",
"db": "VULHUB",
"id": "VHN-37913"
},
{
"date": "2009-02-18T22:17:00",
"db": "BID",
"id": "33523"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-003237"
},
{
"date": "2017-09-29T01:33:49.950000",
"db": "NVD",
"id": "CVE-2009-0467"
},
{
"date": "2009-02-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Profense Web Application Firewall of proxy.html Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-003237"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200902-234"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…