ID de Prueba:	1.3.6.1.4.1.25623.1.0.804244
Categoría:	Web application abuses
Título:	POSH Multiple Vulnerabilities
Resumen:	POSH is prone to multiple vulnerabilities.
Descripción:	Summary: POSH is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - An input passed via the 'rssurl' parameter to 'addtoapplication.php' and 'error' parameter to 'login.php', which is not properly sanitised before using it. - It stores the username and md5 digest of the password in the cookie. - Improper validation of the 'redirect' parameter upon submission to the /posh/portal/scr_sendmd5.php script. Vulnerability Impact: Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials, execute SQL commands and obtain sensitive information. Affected Software/OS: POSH version before 3.3.0 Solution: Upgrade to version POSH version 3.3.0 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2211 BugTraq ID: 65817 http://www.securityfocus.com/bid/65817 http://www.sysdream.com/CVE-2014-2211_2214 http://www.sysdream.com/system/files/POSH-3.2.1-advisory_0.pdf http://seclists.org/oss-sec/2014/q1/444 Common Vulnerability Exposure (CVE) ID: CVE-2014-2212 Common Vulnerability Exposure (CVE) ID: CVE-2014-2213 http://www.securityfocus.com/bid/65843 https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/ Common Vulnerability Exposure (CVE) ID: CVE-2014-2214
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.