The host is running Tembria Server Monitor and is prone to cross-site scripting and information disclosure vulnerabilities.

Successful exploitation will allow attacker to gain the sensitive information about the user, session, and application and using XSS, an attacker could insert malicious code into a web page and entice users to execute the malicious code. Impact Level: Application

Upgrade Tembria Server Monitor version 6.0.5 Build 2252 or later, For updates refer tohttp://www.tembria.com/download

Multiple flaws are due to, - An error in the Web application management interface, which allows for execution of Cross-site Scripting (XSS) attacks. - An error in Tembria Server Monitor application allowing an attacker to easily decrypt usernames and passwords used to authenticate to the application.

Tembria Server Monitor Version 6.0.4 Build 2229 and prior.

• http://seclists.org/bugtraq/2011/Feb/176
• http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-Weak-Xpto-Pwd-Storage.html
• http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-XSS.html

---

Updated on 2015-03-25