ucosminexus_developer_standard,cosminexus_application_server_standard,ucosminexus_service_platform,web_server,cosminexus_developer_professional_version_6,cosminexus_server,cosminexus_application_server_enterprise,ucosminexus_service_architect,ucosminexus_application_server_enterprise,ucosminexus_developer_professional,cosminexus_developer_light_version_6,ucosminexus_application_server_standard,cosminexus_developer_standard_version_6,ucosminexus_developer_light 跨站脚本漏洞

CVE编号

CVE-2007-5809

利用情况

暂无

补丁情况

N/A

披露时间

2007-11-06

漏洞描述

Cross-site scripting (XSS) vulnerability in Hitachi Web Server 01-00 through 03-10, as used by certain Cosminexus products, allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP requests that trigger creation of a server-status page.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://osvdb.org/42027
http://secunia.com/advisories/27421
http://www.hitachi-support.com/security_e/vuls_e/HS07-035_e/index-e.html
http://www.securityfocus.com/bid/26271
http://www.vupen.com/english/advisories/2007/3666

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	hitachi	cosminexus_application_server_enterprise	*		Up to (including) 06_51_j
	运行在以下环境
	应用	hitachi	cosminexus_application_server_standard	*		Up to (including) 06_51_j
	运行在以下环境
	应用	hitachi	cosminexus_developer_light_version_6	*		Up to (including) 06_51_j
	运行在以下环境
	应用	hitachi	cosminexus_developer_professional_version_6	*		Up to (including) 06_51_j
	运行在以下环境
	应用	hitachi	cosminexus_developer_standard_version_6	*		Up to (including) 06_51_j
	运行在以下环境
	应用	hitachi	cosminexus_server	*		Up to (including) 04_01
	运行在以下环境
	应用	hitachi	ucosminexus_application_server_enterprise	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	ucosminexus_application_server_standard	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	ucosminexus_developer_light	*		Up to (including) 06_71_d
	运行在以下环境
	应用	hitachi	ucosminexus_developer_professional	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	ucosminexus_developer_standard	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	ucosminexus_service_architect	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	ucosminexus_service_platform	*		Up to (including) 07_50_01
	运行在以下环境
	应用	hitachi	web_server	01_00	-
	运行在以下环境
	应用	hitachi	web_server	01_01	-
	运行在以下环境
	应用	hitachi	web_server	01_01_d	-
	运行在以下环境
	应用	hitachi	web_server	01_02_d	-
	运行在以下环境
	应用	hitachi	web_server	01_02_e	-
	运行在以下环境
	应用	hitachi	web_server	02_00	-
	运行在以下环境
	应用	hitachi	web_server	02_00_a	-
	运行在以下环境
	应用	hitachi	web_server	02_02	-
	运行在以下环境
	应用	hitachi	web_server	02_04_b	-
	运行在以下环境
	应用	hitachi	web_server	02_06_a	-
	运行在以下环境
	应用	hitachi	web_server	03_00	-
	运行在以下环境
	应用	hitachi	web_server	03_00_01	-

CVSS3评分 4.3

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 需要
• 可用性 无
• 保密性 无
• 完整性 部分地

AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-ID	漏洞类型
CWE-79	在Web页面生成时对输入的转义处理不恰当（跨站脚本）

Exp相关链接

- avd.aliyun.com