CVE-2016-1926: XSS
Published Jan 26, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the charts module in Greenbone Security Assistant (GSA) 6.x before 6.0.8 allows remote attackers to inject arbitrary web script or HTML via the aggregatetype parameter in a getaggregate command to omp.
Affected Software
29 affected components
Greenbone Greenbone Security Assistant=6.0.0
Greenbone Greenbone Security Assistant=6.0.1
Greenbone Greenbone Security Assistant=6.0.2
Greenbone Greenbone Security Assistant=6.0.3
Greenbone Greenbone Security Assistant=6.0.4
Greenbone Greenbone Security Assistant=6.0.5
Greenbone Greenbone Security Assistant=6.0.6
Greenbone Greenbone Security Assistant=6.0.7
Greenbone Greenbone OS=3.1.1
Greenbone Greenbone OS=3.1.6
Greenbone Greenbone OS=3.1.7
Greenbone Greenbone OS=3.1.8
Greenbone Greenbone OS=3.1.9
Greenbone Greenbone OS=3.1.10
Greenbone Greenbone OS=3.1.11
Greenbone Greenbone OS=3.1.12
Greenbone Greenbone OS=3.1.13
Greenbone Greenbone OS=3.1.14
Greenbone Greenbone OS=3.1.15
Greenbone Greenbone OS=3.1.16
Greenbone Greenbone OS=3.1.17
Greenbone Greenbone OS=3.1.18
Greenbone Greenbone OS=3.1.19
Greenbone Greenbone OS=3.1.20
Greenbone Greenbone OS=3.1.21
Greenbone Greenbone OS=3.1.22
Greenbone Greenbone OS=3.1.23
Fedoraproject Fedora=22
Fedoraproject Fedora=23
Event History
Jan 26, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1926?
CVE-2016-1926 is considered a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2016-1926?
To fix CVE-2016-1926, upgrade to Greenbone Security Assistant version 6.0.8 or later.
3
What is affected by CVE-2016-1926?
CVE-2016-1926 affects Greenbone Security Assistant versions 6.0.0 through 6.0.7.
4
What kind of attack is CVE-2016-1926 used for?
CVE-2016-1926 can be exploited to execute arbitrary web scripts or HTML through the aggregate_type parameter.
5
Is there a workaround for CVE-2016-1926?
No specific workaround is recommended for CVE-2016-1926; however, upgrading to the patched version is the best solution.