CVE-2011-2159 Other in n/a

Critical 10.0 Published 20 May 2011 Updated 6 Aug 2024

Missing Content-Type headers in SmarterStats may allow remote attackers to cause interpretation conflicts, potentially affecting clients.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2011-2159?

CVE-2011-2159 is a critical vulnerability in n/a, published on 20 May 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/Defaults/frmDefaultSiteSettings.aspx, (2) Admin/Defaults/frmServerDefaults.aspx, (3) Admin/frmReportSettings.aspx, (4) Admin/frmSite.aspx, (5) App_Themes/Default/ButtonBarIcons.xml, (6) App_Themes/Default/Skin.xml, (7) Client/frmImportSettings.aspx, (8) Client/frmSeoSettings.aspx, (9) Services/Web.config, (10) aspnet_client/system_web/4_0_30319/, (11) clientaccesspolicy.xml, (12) cloudscan.exe, (13) crossdomain.xml, or (14) sitemap.xml. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.

Which versions are affected by CVE-2011-2159?

It affects 1 product.

Products include Smartertools Smarterstats.

How do I fix CVE-2011-2159?

No fix has been published for CVE-2011-2159 yet. Limit exposure of the affected software until one is available.

Is CVE-2011-2159 being exploited?

There is no known exploitation of CVE-2011-2159 in the wild and no public exploit code.

Sources

Also known as GHSA-937x-j2xw-8rfq.