Blind XPath Injection vulnerability found by security scan (4370944)

立即与支持人员聊天

反馈已提交

本文是否解决了您的问题？

选择评级

标题

Blind XPath Injection vulnerability found by security scan
说明
The following weaknesses were uncovered by a security scan in the https://[foglight_server]:[port]/login/ URL 'redirect_uri' query parameter:
1. (High) Phishing Through URL Redirection [CWE-601]
2. (Medium) Blind XPath Injection [CWE-91]
原因

https://cwe.mitre.org/data/definitions/601.html
https://cwe.mitre.org/data/definitions/91.html
解决办法

Foglight is not vulnerable to Blind XPath Injection in CWE-91 since it does not use any XPath expressions in the reported URL.

STATUS

This issue has been logged as defect FOG-4447 to address URL Redirection in CWE-601 and avoid false positives for Blind XPath Injection in CWE-91.

Waiting for fix in a future release of the Foglight Management Server.
缺陷ID

FOG-4447

反馈已提交

本文是否解决了您的问题？

选择评级

建议的内容

产品：: Foglight
6.3.0, 6.1.0, 6.0.0, 5.9.8; Foglight Evolve
6.3.0, 6.1.0, 9.3; Foglight for Databases
6.3.0, 6.1.0, 6.0.0, 5.9.7

标题