5

CVE-2011-3140

Exploit
IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention by dividing a dangerous parameter value into substrings, as demonstrated by a SQL statement that is split across multiple iid parameters and then sent to a .aspx file on an IIS web server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ G400 Ips-g400-ib-1 Appliance Version31.030
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.15% 0.798
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://securityreason.com/securityalert/8339
http://securitytracker.com/id?1025683
Exploit
http://www.iss.net/security_center/reference/vuln/HTTP_Parameter_Abuse.htm
http://www.securityfocus.com/archive/1/518556/100/0/threaded
http://www.securityfocus.com/bid/48370
https://exchange.xforce.ibmcloud.com/vulnerabilities/67178
https://www.trustwave.com/spiderlabs/advisories/TWSL2011-006.txt
Exploit