Bloxx Web Filter Multiple Remote Security Vulnerabilities
BID:53715
Info
Bloxx Web Filter Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 53715 |
| Class: | Unknown |
| CVE: |
CVE-2012-2563 CVE-2012-2564 CVE-2012-2565 CVE-2012-2566 |
| Remote: | Yes |
| Local: | No |
| Published: | May 29 2012 12:00AM |
| Updated: | May 29 2012 12:00AM |
| Credit: | Travis Lee |
| Vulnerable: |
Bloxx Bloxx Web Filter 5.0.13 |
| Not Vulnerable: |
Bloxx Bloxx Web Filter 5.0.14 |
Discussion
Bloxx Web Filter Multiple Remote Security Vulnerabilities
Bloxx Web Filter is prone to the following issues:
1. A security bypass vulnerability.
2. Multiple cross-site request-forgery vulnerabilities.
3. Multiple HTML-injection vulnerabilities.
4. An information disclosure vulnerability.
Attackers can exploit these issues to run HTML or JavaScript code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials, to gain unauthorized access to the application, to bypass certain security restrictions or to disclose sensitive information; other attacks are also possible.
Bloxx Web Filter is prone to the following issues:
1. A security bypass vulnerability.
2. Multiple cross-site request-forgery vulnerabilities.
3. Multiple HTML-injection vulnerabilities.
4. An information disclosure vulnerability.
Attackers can exploit these issues to run HTML or JavaScript code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials, to gain unauthorized access to the application, to bypass certain security restrictions or to disclose sensitive information; other attacks are also possible.
Exploit / POC
Bloxx Web Filter Multiple Remote Security Vulnerabilities
Attackers can use a browser to exploit these issues. For cross-site scripting and cross-site request-forgery attacks, attackers will entice unsuspecting users to follow a malicious URI.
Attackers can use a browser to exploit these issues. For cross-site scripting and cross-site request-forgery attacks, attackers will entice unsuspecting users to follow a malicious URI.
Solution / Fix
Bloxx Web Filter Multiple Remote Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Bloxx Web Filter Multiple Remote Security Vulnerabilities
References:
References:
- Bloxx Web Filtering Homepage (Bloxx)
- Bloxx Web Filter multiple vulnerabilities (US-CERT)