Cross-Site Scripting Flaw in Greenbone Security Assistant by Greenbone
CVE-2016-1926

6.1MEDIUM

Key Information:

Vendor

Greenbone

Status
Greenbone Security Assistant
Vendor
CVE Published:
26 January 2016

What is CVE-2016-1926?

The Greenbone Security Assistant (GSA) version 6.x prior to 6.0.8 contains a cross-site scripting vulnerability in its charts module. This flaw permits remote attackers to execute arbitrary web scripts or HTML by manipulating the aggregate_type parameter within a get_aggregate command to the Open Management Protocol (OMP). Successful exploitation could lead to unauthorized actions being performed in the context of the user’s session, potentially compromising sensitive information.

References

https://en.internetwache.org/cve-2016-1926-xss-in-the-gre...
x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce...
vendor-advisoryx_refsource_FEDORA
http://www.greenbone.net/technology/gbsa2016-01.html
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.