HTTP: HTML Script Tag Embedded in User-Agent

This signature detects cross site scripting attacks. Attackers can create a malicious Web site that includes HTML embedded in the hyperlinks, which might violate site security settings. Attackers can then view the Web cookies from a target computer. Web cookies typically contain sensitive information such as usernames, passwords, credit card numbers, social security numbers, and bank account numbers.

Extended Description

raSMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Affected Products

Rasmp rasmp

References

BugTraq: 71180 16138

CVE: CVE-2023-0992

URL: https://getshieldsecurity.com/changelog/?utm_source=changelog&utm_medium=plugin-readme&utm_content=release&utm_campaign=Shield-Security-Pro https://www.wordfence.com/blog/2023/04/multiple-vulnerabilities-patched-in-shield-security/

Short Name

HTTP:XSS:HTML-SCRIPT-IN-UA

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: HTML Script Tag Embedded in User-Agent

Extended Description

Affected Products

References

Found a potential security threat?