Unscored severity · published Jul 9, 2012
CVE-2012-3238
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Security Gateway · Astaro
All versions, or not specified · source: NVD
SG
Security Gateway Software · Astaro
through 8.3 · source: NVD
UT
Unified Threat Management · Sophos
110; 120; 220; 320; 425; 525; +1 more · source: NVD
UT
Unified Threat Management Software · Sophos
through 8.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3238
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0206.html
Exploit
http://security.inshell.net/advisory/27
Patch
http://www.astaro.com/en-uk/blog/up2date/8305
More from Security Gateway
–
CVE-2007-4242
The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not perform virus scanning of attachments that exceed the maximum attachment size, and passes these attachments, which…
–
CVE-2007-4243
Unspecified vulnerability in pfilter-reporter.pl in Astaro Security Gateway (ASG) 7 allows remote attackers to cause a denial of service (CPU consumption) via certain network…
–
CVE-2007-3253
Multiple unspecified vulnerabilities in Astaro Security Gateway (ASG) before 7.005 allow remote attackers to cause a denial of service via (1) certain email, which stops the SMTP…