Nessus Web Server Plugin Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	41966
Class:	Input Validation Error
CVE:	CVE-2010-1969
Remote:	Yes
Local:	No
Published:	Jul 26 2010 12:00AM
Updated:	Mar 19 2015 08:21AM
Credit:	Emmanuel Bouillon
Vulnerable:	Tenable Nessus Web Server 0
Not Vulnerable:	Tenable Nessus Web Server 1.2.4

Nessus Web Server Plugin Unspecified Cross Site Scripting Vulnerability

Nessus Web Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Nessus Web Server 1.2.4 are vulnerable.

Nessus Web Server Plugin Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Nessus Web Server Plugin Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available; please see the references for more information.

Nessus Web Server Plugin Unspecified Cross Site Scripting Vulnerability

References:

• [Security] nessusd_www_server.nbin cross site scripting and version disclosure (Tenable Network Security)
  
• Nessus Home Page (Tenable Network Security)
  
• Nessus Vulnerabilities ([email protected])