Detections
Analytics
BASE < 1.4.4 base_local_rules.php dir Parameter XSS
medium Nessus Plugin ID 42264
Language:
Synopsis
A web application on the remote host has a cross-site scripting vulnerability.Description
The version of Basic Analysis and Security Engine (BASE) running on the remote host has a cross-site scripting vulnerability. Input to the 'dir' parameter of base_local_rules.php is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL.Solution
Upgrade to BASE 1.4.4 or later.See Also
Plugin Details
Severity: Medium
ID: 42264
File Name: base_local_rules_xss.nasl
Version: 1.13
Type: remote
Family: CGI abuses : XSS
Published: 10/27/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:secureideas:basic_analysis_and_security_engine
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/11/2009
Vulnerability Publication Date: 8/11/2009
Reference Information
BID: 36830