Debian DSA-1275-1 zope2.7 cross-site scripting vulnerabilit
Reporter | Title | Published | Views | Family All 17 |
---|---|---|---|---|
![]() | [SECURITY] [DSA 1275-1] New zope2.7 packages fix cross-site scripting flaw | 2 Apr 200723:24 | – | debian |
![]() | [SECURITY] [DSA 1275-1] New zope2.7 packages fix cross-site scripting flaw | 2 Apr 200723:24 | – | debian |
![]() | openSUSE 10 Security Update : zope (zope-3346) | 17 Oct 200700:00 | – | nessus |
![]() | FreeBSD : zope -- XSS vulnerability (34414a1e-e377-11db-b8ab-000c76189c4c) | 10 Apr 200700:00 | – | nessus |
![]() | Debian: Security Advisory (DSA-1275-1) | 17 Jan 200800:00 | – | openvas |
![]() | FreeBSD Ports: zope | 4 Sep 200800:00 | – | openvas |
![]() | FreeBSD Ports: zope | 4 Sep 200800:00 | – | openvas |
![]() | Debian Security Advisory DSA 1275-1 (zope2.7) | 17 Jan 200800:00 | – | openvas |
![]() | Cross site scripting | 22 Mar 200718:19 | – | prion |
![]() | CVE-2007-0240 | 22 Mar 200718:19 | – | cve |
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DSA-1275. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(25009);
script_version("1.18");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");
script_cve_id("CVE-2007-0240");
script_bugtraq_id(23084);
script_xref(name:"DSA", value:"1275");
script_name(english:"Debian DSA-1275-1 : zope2.7 - XSS");
script_summary(english:"Checks dpkg output for the updated package");
script_set_attribute(
attribute:"synopsis",
value:"The remote Debian host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"A cross-site scripting vulnerability in zope, a web application
server, could allow an attacker to inject arbitrary HTML and/or
JavaScript into the victim's web browser. This code would run within
the security context of the web browser, potentially allowing the
attacker to access private data such as authentication cookies, or to
affect the rendering or behavior of zope web pages."
);
script_set_attribute(
attribute:"see_also",
value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=416500"
);
script_set_attribute(
attribute:"see_also",
value:"http://www.debian.org/security/2007/dsa-1275"
);
script_set_attribute(
attribute:"solution",
value:
"Upgrade the zope2.7 package.
For the stable distribution (sarge), this problem has been fixed in
version 2.7.5-2sarge4.
The upcoming stable distribution (etch) and the unstable distribution
(sid) include zope2.9, and this vulnerability is fixed in version
2.9.6-4etch1 for etch and 2.9.7-1 for sid."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:zope2.7");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");
script_set_attribute(attribute:"patch_publication_date", value:"2007/04/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2007/04/10");
script_set_attribute(attribute:"vuln_publication_date", value:"2007/03/20");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.");
script_family(english:"Debian Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("debian_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (deb_check(release:"3.1", prefix:"zope2.7", reference:"2.7.5-2sarge4")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
else security_warning(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo