(PVS) Signatures - Tenable Network Security

Mantis Cross-Site Request Forgery Vulnerabilities
PVS ID: 4506 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:32324
Description: Synopsis : \n\nThe remote web server contains a PHP application that is affected by
multiple cross-site request forgery vulnerabilities.\n\nThe version of Mantis Bug Tracker
installed on the remote host does not verify the validity of HTTP requests before
performing various administrative actions. If a remote attacker can trick a logged-in
administrator into viewing a specially-crafted page, he can leverage this issue to launch
cross-site request forgery attacks against the affected application, such as creating
additional users with administrator privileges. The reported version is: \n %L
Solution: Upgrade to Mantis 1.2.0a1 or later.
CVE Not available
SUN Java System Application Server Version Detection
PVS ID: 4507 FAMILY: Web Servers RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the SUN Java system application server. The version is: '%L'
Solution: N/A
CVE Not available
JSP information disclosure in Sun Java System application server
PVS ID: 4508 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks\n\nThe remote host is running the SUN Java system application server. The version
is: '%L'.\nThis version is reported vulnerable to a flaw in the way that it handles requests
for '.jsp' code files. An attacker, exploiting this flaw, would be able to gain access to '.jsp'
source code which could give an attacker information useful in future attacks. \nIAVB
Reference : 2008-B-0045\nSTIG Finding Severity : Category II
Solution: SUN has released a fix for this version of their server. Apply the referenced patches.
CVE-2008-2120
cPanel Remote Privilege Escalation vulnerability
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4509 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a remote 'privilege escalation' flaw\n\nThe
remote host is running cpanel, a web-hosting control panel. The remote version of this
software is vulnerable to a flaw wherein users can gain Administrative access. The root of
the flaw is in the way that this version of cPanel allows new user accounts to access the
Family Internet Services 1177