CVE-2011-2158
First published: Fri May 20 2011(Updated: )
The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/frmSite.aspx, (2) Admin/frmSites.aspx, (3) Admin/frmViewReports.aspx, (4) App_Themes/AboutThisFolder.txt, (5) Client/frmViewReports.aspx, (6) Temp/AboutThisFolder.txt, (7) default.aspx, (8) login.aspx, or (9) certain .jpg URIs under Temp/. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SmarterTools SmarterStats | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
- http://www.kb.cert.org/vuls/id/MORO-8GYQR4
- http://www.kb.cert.org/vuls/id/240150
- http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67824
Frequently Asked Questions
What is the severity of CVE-2011-2158?
CVE-2011-2158 has been rated as a medium severity vulnerability due to potential security implications from incorrect Content-Type headers.
How do I fix CVE-2011-2158?
To fix CVE-2011-2158, update to a newer version of SmarterStats that resolves the Content-Type header issue.
What impact does CVE-2011-2158 have on my system?
CVE-2011-2158 may allow remote attackers to exploit content interpretation conflicts, potentially leading to unauthorized access or manipulation.
Is CVE-2011-2158 applicable to versions other than 6.0 of SmarterStats?
CVE-2011-2158 specifically affects SmarterStats version 6.0 and may not impact other versions.
How does CVE-2011-2158 enable potential remote attacks?
CVE-2011-2158 enables potential remote attacks by incorrectly setting Content-Type headers, which can lead to confusion in resource handling.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/smartertools
- canonical/smartertools smarterstats
- version/smartertools smarterstats/6.0