var-201207-0071
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field. Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Astaro Security Gateway 8.304 is vulnerable; other versions may also be affected. Inshell Security Advisory http://www.inshell.net/
1. CREDITS
This vulnerability was discovered and researched by Julien Ahrens from Inshell Security.
The vulnerability is located in the backup-function of the software:
Vulnerable Module(s): +Management -> Backup/Restore Parameter: "Comment (optional)"
The input field "Comment (optional)" is shown on the "Available backups" view after successful creation of a new backup and is also included into the backup-file itself.
Due to improper input - validation of this input field, an attacker could permanently inject arbitrary code with required user interaction into the context of the firewall-interface. Successful exploitation of the vulnerability allows for example cookie theft, session hijacking or server side context manipulation.
5. PROOF-OF-CONCEPT (CODE / EXPLOIT)
An attacker needs to force the victim to import an arbitrary backup-file. The victim does not need to apply the backup, only the import is required to exploit the vulnerability.
For further information (screenshots, PoCs etc.) visit: http://security.inshell.net/advisory/27
6. SOLUTION
Update to v8.305.
7. REPORT TIMELINE
2012-05-12: Initial notification sent to vendor 2012-05-12: Vendor response 2012-05-12: Vulnerability details reported to vendor 2012-05-15: Vendor acknowledgement 2012-05-31: Vendor releases Update / Fix 2012-06-10: Coordinated public release of advisory
8. REFERENCES
http://www.astaro.com/en-uk/blog/up2date/8305 http://security.inshell.net
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201207-0071",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "425"
},
{
"model": "unified threat management software",
"scope": "lte",
"trust": 1.0,
"vendor": "sophos",
"version": "8.3"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "320"
},
{
"model": "security gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "astaro",
"version": "*"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "120"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "625"
},
{
"model": "security gateway software",
"scope": "lte",
"trust": 1.0,
"vendor": "astaro",
"version": "8.3"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "110"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "220"
},
{
"model": "unified threat management",
"scope": "eq",
"trust": 1.0,
"vendor": "sophos",
"version": "525"
},
{
"model": "security gateway",
"scope": "lt",
"trust": 0.8,
"vendor": "astaro",
"version": null
},
{
"model": "security gateway software",
"scope": "lt",
"trust": 0.8,
"vendor": "astaro",
"version": "8.305"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "110"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "120"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "220"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "320"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "425"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "525"
},
{
"model": "utm",
"scope": "eq",
"trust": 0.8,
"vendor": "sophos",
"version": "625"
},
{
"model": "utm software",
"scope": "lt",
"trust": 0.8,
"vendor": "sophos",
"version": "8.305"
},
{
"model": "unified threat management software",
"scope": "eq",
"trust": 0.6,
"vendor": "sophos",
"version": "8.3"
},
{
"model": "security gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "astaro",
"version": "8.304"
},
{
"model": "security gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "astaro",
"version": "8.300"
},
{
"model": "security gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "astaro",
"version": "8.1"
},
{
"model": "security gateway",
"scope": "ne",
"trust": 0.3,
"vendor": "astaro",
"version": "8.305"
}
],
"sources": [
{
"db": "BID",
"id": "53939"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:astaro:security_gateway_software:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:astaro:security_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sophos:unified_threat_management_software:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:120:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:320:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:525:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:110:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:625:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:220:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sophos:unified_threat_management:425:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-3238"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Julien Ahrens (MrTuxracer)",
"sources": [
{
"db": "BID",
"id": "53939"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
],
"trust": 0.9
},
"cve": "CVE-2012-3238",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2012-3238",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-56519",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-3238",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201206-302",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-56519",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the \"Comment (optional)\" field. Astaro Security Gateway is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. \nAttacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. \nAstaro Security Gateway 8.304 is vulnerable; other versions may also be affected. Inshell Security Advisory\nhttp://www.inshell.net/\n\n\n1. CREDITS\n----------\nThis vulnerability was discovered and researched by Julien Ahrens from\nInshell Security. \n\n\n3. \n\n\n4. \n\nThe vulnerability is located in the backup-function of the software:\n\nVulnerable Module(s):\n+Management -\u003e Backup/Restore\n Parameter: \"Comment (optional)\"\n\nThe input field \"Comment (optional)\" is shown on the \"Available backups\"\nview after successful creation of a new backup and is also included into\nthe backup-file itself. \n\nDue to improper input - validation of this input field, an attacker\ncould permanently inject arbitrary code with required user interaction\ninto the context of the firewall-interface. Successful exploitation of\nthe vulnerability allows for example cookie theft, session hijacking or\nserver side context manipulation. \n\n\n5. PROOF-OF-CONCEPT (CODE / EXPLOIT)\n------------------------------------\nAn attacker needs to force the victim to import an arbitrary\nbackup-file. The victim does not need to apply the backup, only the\nimport is required to exploit the vulnerability. \n\nFor further information (screenshots, PoCs etc.) visit:\nhttp://security.inshell.net/advisory/27\n\n\n6. SOLUTION\n-----------\nUpdate to v8.305. \n\n\n7. REPORT TIMELINE\n------------------\n2012-05-12: Initial notification sent to vendor\n2012-05-12: Vendor response\n2012-05-12: Vulnerability details reported to vendor\n2012-05-15: Vendor acknowledgement\n2012-05-31: Vendor releases Update / Fix\n2012-06-10: Coordinated public release of advisory\n\n\n8. REFERENCES\n-------------\nhttp://www.astaro.com/en-uk/blog/up2date/8305\nhttp://security.inshell.net\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "BID",
"id": "53939"
},
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "PACKETSTORM",
"id": "113501"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-56519",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-3238",
"trust": 2.9
},
{
"db": "BID",
"id": "53939",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302",
"trust": 0.7
},
{
"db": "FULLDISC",
"id": "20120610 [CVE-2012-3238] ASTARO SECURITY GATEWAY \u003c= V8.304 PERSISTENT CROSS-SITE SCRIPTING VULNERABILITY",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "113501",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-56519",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "BID",
"id": "53939"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "PACKETSTORM",
"id": "113501"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"id": "VAR-201207-0071",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:45:42.927000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Up2Date 8.305 Released",
"trust": 0.8,
"url": "http://www.astaro.com/en-uk/blog/up2date/8305"
},
{
"title": "Sophos UTM",
"trust": 0.8,
"url": "http://www.sophos.com/ja-jp/products/unified/utm.aspx"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sophos.com/ja-jp/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://www.astaro.com/en-uk/blog/up2date/8305"
},
{
"trust": 2.1,
"url": "http://security.inshell.net/advisory/27"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0206.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3238"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3238"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/53939"
},
{
"trust": 0.3,
"url": "http://www.astaro.com/"
},
{
"trust": 0.3,
"url": "/archive/1/523075"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3238"
},
{
"trust": 0.1,
"url": "http://security.inshell.net"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://www.sophos.com"
},
{
"trust": 0.1,
"url": "http://www.inshell.net/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "BID",
"id": "53939"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "PACKETSTORM",
"id": "113501"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-56519"
},
{
"db": "BID",
"id": "53939"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"db": "PACKETSTORM",
"id": "113501"
},
{
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-56519"
},
{
"date": "2012-06-12T00:00:00",
"db": "BID",
"id": "53939"
},
{
"date": "2012-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"date": "2012-06-12T00:02:00",
"db": "PACKETSTORM",
"id": "113501"
},
{
"date": "2012-07-09T22:55:01.197000",
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"date": "2012-06-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-10T00:00:00",
"db": "VULHUB",
"id": "VHN-56519"
},
{
"date": "2012-06-12T00:00:00",
"db": "BID",
"id": "53939"
},
{
"date": "2012-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003034"
},
{
"date": "2012-07-10T04:00:00",
"db": "NVD",
"id": "CVE-2012-3238"
},
{
"date": "2012-06-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Astaro Security Gateway Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003034"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "113501"
},
{
"db": "CNNVD",
"id": "CNNVD-201206-302"
}
],
"trust": 0.7
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.