VulnerabilityModified

CVE-2011-2158

HIGH 10.0EPSS 4.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/frmSite.aspx, (2) Admin/frmSites.aspx, (3) Admin/frmViewReports.aspx, (4) App_Themes/AboutThisFolder.txt, (5) Client/frmViewReports.aspx, (6) Temp/AboutThisFolder.txt, (7) default.aspx, (8) login.aspx, or (9) certain .jpg URIs under Temp/. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 4.38% probability · 91th percentile
CISA KEV: Not listed
Affected: smartertools/smarterstats
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.