The host is running Mbedthis AppWeb Server and is prone to cross site scripting vulnerability.

Successful exploitation could allow attackers to gain sensitive information or inject arbitrary web script or HTML. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Impact Level: System/Application

Disable TRACE method or upgrade to Mbedthis AppWeb 2.2.2 or later For updates refer to http://appwebserver.org/index.html

The flaw is due to improper handling of HTTP requests using the 'TRACE' method, which allows attackers to inject arbitrary HTML via crafted HTTP TRACE request.

Mbedthis AppWeb versions prior to 2.2.2

• http://osvdb.org/35511
• http://secunia.com/advisories/25636
• http://www.appwebserver.org/forum/viewtopic.php?t=996
• http://www.kb.cert.org/vuls/id/867593
• http://xforce.iss.net/xforce/xfdb/34854

---

Updated on 2015-03-25