Red Hat Bugzilla – Bug 1300683
CVE-2016-1926 openvas-gsa: XSS vulnerability due to improper handling of the parameters of get_aggregate command
Last modified: 2016-06-03 09:18:31 EDT
It was reported that openvas-gsa is vulnerable to cross-site scripting due to improper handling of parameters of get_aggregate command. If the attacker has access to a session token of the browser session, the cross site scripting can be executed. Affects versions >= 6.0.0 and < 6.0.8.
Created openvas-gsa tracking bugs for this issue:
Affects: fedora-all [bug 1300684]
Affects: epel-all [bug 1300685]
openvas-cli-1.4.4-1.fc23, openvas-gsa-6.0.10-3.fc23, openvas-libraries-8.0.7-2.fc23, openvas-manager-6.0.8-2.fc23, openvas-scanner-5.0.5-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
openvas-cli-1.4.4-1.fc22, openvas-gsa-6.0.10-3.fc22, openvas-libraries-8.0.7-2.fc22, openvas-manager-6.0.8-2.fc22, openvas-scanner-5.0.5-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
openvas-cli-1.4.4-1.el7, openvas-gsa-6.0.10-3.el7, openvas-libraries-8.0.7-2.el7, openvas-manager-6.0.8-2.el7, openvas-scanner-5.0.5-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.