Summary
The remote host seems to be running cvstrac,
a web-based bug and patch-set tracking system for CVS.
This version contains a flaw related to ticket titles containing a semi-colon ('
') that may allow an attacker
to execute arbitrary commands on the system.
***** OVS has determined the vulnerability exists on the target ***** simply by looking at the version number(s) of CVSTrac ***** installed there.
Solution
Update to version 1.1.4 or disable this CGI suite
Severity
Classification
-
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Artifectx xClassified 'catid' SQL Injection Vulnerability
- AjaXplorer zoho plugin Directory Traversal Vulnerability
- AIOCP 'cp_html2xhtmlbasic.php' Remote File Inclusion Vulnerability
- Apache Solr XML External Entity(XXE) Vulnerability-02 Jan-14
- ActualAnalyzer Lite 'ant' Cookie Parameter Remote Command Execution Vulnerability