Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Title SearchBlox contains multiple vulnerabilities
Name VU#697316 First vendor Publication 2015-04-14
Vendor VU-CERT Last vendor Modification 2015-04-14
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#697316

SearchBlox contains multiple vulnerabilities

Original Release date: 14 Apr 2015 | Last revised: 14 Apr 2015


SearchBlox versions 8.1.x and below contain multiple vulnerabilities.


CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CVE-2015-0967

SearchBlox contains multiple cross-site scripting (XSS) vulnerabilities, including a reflected XSS in the default search box of http://<HOST_NAME>:8080/searchblox/plugin/index.html and a persistent XSS in the title field of the 'Create Featured Result' form, http://<HOST_NAME>:8080/searchblox/admin/main.jsp?menu1=res. Note that an attacker must be authenticated to leverage the persistent XSS.

CWE-434: Unrestricted File Upload of File with Dangerous Type - CVE-2015-0968

Active content, such as JSP pages, can be uploaded to http://<HOST_NAME>:8080/searchblox/admin/uploadImage.html. This can be done by submitting the content using the form and using a client proxy to ensure that the "Content-Type" for the uploaded file is "image/jpeg". The attacker can then visit the uploaded content and enable its execution. Note that though the URL in question appears to be in an authenticated portion of the server, the page can be accessed without authentication.

This issue was previously published in VU#592942 (see CVE-2013-3590) and reportedly addressed in version 7.5 build 1. SearchBlox 8.1.5 and possibly earlier versions have since been found to be vulnerable.

CWE-200: Information Exposure - CVE-2015-0969

Potentially sensitive information can be viewed by unauthenticated users who directly access http://<HOST_NAME>:9200/_cluster/health?pretty=true.

CWE-352: Cross-Site Request Forgery (CSRF) - CVE-2015-0970

SearchBlox contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.

The CVSS score below describes CVE-2015-0968.


A remote, unauthenticated attacker may be able to execute arbitrary script in the contexts of the end-user's browser session, the application, or an authenticated user. Sensitive information may be exposed to unauthenticated users.


Apply an update

SearchBlox has addressed these issues in version 8.2.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
SearchBloxAffected27 Feb 201510 Apr 2015
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)



  • http://www.searchblox.com/downloads
  • http://www.kb.cert.org/vuls/id/592942
  • http://cwe.mitre.org/data/definitions/79.html
  • https://cwe.mitre.org/data/definitions/434.html
  • http://cwe.mitre.org/data/definitions/200.html
  • http://cwe.mitre.org/data/definitions/352.html


Thanks to Ashish Kamble of Qualys for reporting this vulnerability.

This document was written by Joel Land.

Other Information

  • CVE IDs:CVE-2015-0967CVE-2015-0968CVE-2015-0969CVE-2015-0970
  • Date Public:14 Apr 2015
  • Date First Published:14 Apr 2015
  • Date Last Updated:14 Apr 2015
  • Document Revision:14


If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/697316

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-352 Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
33 % CWE-200 Information Exposure
33 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Application 11

Snort® IPS/IDS

Date Description
2017-04-06 ElasticSearch cluster health access detected
RuleID : 41816 - Revision : 1 - Type : POLICY-OTHER

Alert History

If you want to see full details history, please login or register.
Date Informations
2015-04-20 21:31:37
  • Multiple Updates
2015-04-18 09:31:36
  • Multiple Updates
2015-04-14 17:24:27
  • First insertion