{"vuid":"VU#274244","idnumber":"274244","name":"Blue Coat Malware Analysis appliance contains a cross-site scripting (XSS) vulnerability and information disclosure","keywords":[""],"overview":"The Blue Coat Malware Analysis appliance is vulnerable to cross-site scripting (XSS) and information disclosure.","clean_desc":"The Blue Coat Malware Analysis appliance is a sandboxed appliance that scans for threats in files and downloads on the network. A cross-site scripting vulnerability exists in search.php of the appliance. This vulnerability has been assigned CVE-2015-0937. An information disclosure vulnerability exists in search.php of the appliance. By use of a specialized URL parameter, this vulnerability allows a user to search for and obtain a list of documents meeting certain keywords, even if those documents are private. This vulnerability has been assigned CVE-2015-0938. These vulnerabilities have been observed in version 4.2.3.20150129-RELEASE; other releases may also be affected. For more information, please see Blue Coat's security advisory SA94.. The CVSS score below is based on CVE-2015-0937.","impact":"The cross-site scripting vulnerability may allow compromise of user credentials. The information disclosure vulnerability may allow private file data to be obtained by unauthorized users.","resolution":"Update software Blue Coat has addressed these vulnerabilities in version 4.2.4.20150312-RELEASE. Affected users are suggested to upgrade as soon as possible.","workarounds":"","sysaffected":"","thanks":"","author":"This document was written by Garret Wassermann.","public":["h","t","t","p","s",":","/","/","b","t","o",".","b","l","u","e","c","o","a","t",".","c","o","m","/","s","e","c","u","r","i","t","y","-","a","d","v","i","s","o","r","y","/","s","a","9","4"],"cveids":["CVE-2015-0937","CVE-2015-0938"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2015-02-02T11:42:47Z","publicdate":"2015-04-14T00:00:00Z","datefirstpublished":"2015-04-14T14:55:40Z","dateupdated":"2015-04-17T13:26:44Z","revision":28,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"M","cvss_authentication":null,"cvss_confidentialityimpact":"P","cvss_integrityimpact":"P","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"U","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"5.8","cvss_basevector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","cvss_temporalscore":"5.2","cvss_environmentalscore":"3.88840250925","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}