CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
89.0%
SearchBlox versions 8.1.x and below contain multiple vulnerabilities.
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) - CVE-2015-0967
SearchBlox contains multiple cross-site scripting (XSS) vulnerabilities, including a reflected XSS in the default search box of http://<HOST_NAME>:8080/searchblox/plugin/index.html and a persistent XSS in the title field of the ‘Create Featured Result’ form, http://<HOST_NAME>:8080/searchblox/admin/main.jsp?menu1=res. Note that an attacker must be authenticated to leverage the persistent XSS.
CWE-434: Unrestricted File Upload of File with Dangerous Type - CVE-2015-0968
Active content, such as JSP pages, can be uploaded to http://<HOST_NAME>:8080/searchblox/admin/uploadImage.html. This can be done by submitting the content using the form and using a client proxy to ensure that the “Content-Type” for the uploaded file is “image/jpeg”. The attacker can then visit the uploaded content and enable its execution. Note that though the URL in question appears to be in an authenticated portion of the server, the page can be accessed without authentication.
This issue was previously published in VU#592942 (see CVE-2013-3590) and reportedly addressed in version 7.5 build 1. SearchBlox 8.1.5 and possibly earlier versions have since been found to be vulnerable.
CWE-200: Information Exposure - CVE-2015-0969
Potentially sensitive information can be viewed by unauthenticated users who directly access http://<HOST_NAME>:9200/_cluster/health?pretty=true.
CWE-352: Cross-Site Request Forgery (CSRF) - CVE-2015-0970
SearchBlox contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.
The CVSS score below describes CVE-2015-0968.
A remote, unauthenticated attacker may be able to execute arbitrary script in the contexts of the end-user’s browser session, the application, or an authenticated user. Sensitive information may be exposed to unauthenticated users.
Apply an update
SearchBlox has addressed these issues in version 8.2.
697316
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 27, 2015 Updated: April 10, 2015
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
SearchBlox versions 8.1.x and below are affected.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23697316 Feedback>).
Group | Score | Vector |
---|---|---|
Base | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Temporal | 6.2 | E:F/RL:OF/RC:C |
Environmental | 5.5 | CDP:LM/TD:M/CR:M/IR:M/AR:M |
Thanks to Ashish Kamble of Qualys for reporting this vulnerability.
This document was written by Joel Land.
CVE IDs: | CVE-2015-0967, CVE-2015-0968, CVE-2015-0969, CVE-2015-0970 |
---|---|
Date Public: | 2015-04-14 Date First Published: |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
89.0%