Lucene search

K
amazonAmazonALAS-2020-1412
HistoryJul 28, 2020 - 5:22 p.m.

Low: doxygen

2020-07-2817:22:00
alas.aws.amazon.com
20

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.7%

Issue Overview:

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. (CVE-2016-10245)

Affected Packages:

doxygen

Issue Correction:
Run yum update doxygen to update your system.

New Packages:

i686:  
    doxygen-debuginfo-1.8.5-4.14.amzn1.i686  
    doxygen-latex-1.8.5-4.14.amzn1.i686  
    doxygen-1.8.5-4.14.amzn1.i686  
  
src:  
    doxygen-1.8.5-4.14.amzn1.src  
  
x86_64:  
    doxygen-debuginfo-1.8.5-4.14.amzn1.x86_64  
    doxygen-1.8.5-4.14.amzn1.x86_64  
    doxygen-latex-1.8.5-4.14.amzn1.x86_64  

Additional References

Red Hat: CVE-2016-10245

Mitre: CVE-2016-10245

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.7%

Related for ALAS-2020-1412