Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities
From: cve-assign () mitre org
Date: Thu, 12 Dec 2013 00:20:14 -0500 (EST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

https://github.com/mikaku/Monitorix/issues/30
allowable characters in the $target and $target_cgi variables
in lib/HTTPServer.pm

Use CVE-2013-7070.

Note that, at the moment, we think there isn't sufficient evidence
that "session fixation" in this context is an independent
vulnerability, and thus there is no CVE ID for that.


http://www.monitorix.org/news.html also says "3.4.0 version
released ... 02-Dec-2013 ... This version also fixes an important
number of bugs and two security issues ... not covered yet in the
previous 3.3.1 version."

For the XSS issue for the PATH_INFO (aka the $url variable), fixed in
3.4.0, use CVE-2013-7071.

For the other issue (the unspecified issue of the "two security
issues") fixed in 3.4.0, use CVE-2013-7072.

For the out-of-context reference to go.cgi in GoScript, use
CVE-2004-2776.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSqUcEAAoJEKllVAevmvmswZAH/1leJqwAxCnc5u7RKLAWRzHB
88Gu/cWfoEdKPEidBENINQC/sctPkfXz6DEf7r6wtzbMfqtRANnB+GVra0dvDeTj
tkukvV6+QibUDzcIpuqOdEVTorFSF0Vf3bQg2czjJ4vDkPKjgTWz5DCjeBn508Pq
HE/veUJivmWj1xE+cux7muiuHZTpBO9t2IF6/18O2Fzhm0rlpfWWEZWF5UlpmZu0
o1NG+n80+KSSVhYVNczzjPpDEIxelLfcgTvlZWUuKwnOWG9VA4jgu0bBNBDOAHwJ
20o1APNWCWshOrgmvg8CRhneMvKAcQTjiKQDLCkjwFfwB3o/HHNBIusgqSEXG2w=
=f/e4
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault