Test ID:	1.3.6.1.4.1.25623.1.0.106551
Category:	Web application abuses
Title:	TrueConf Multiple Vulnerabilities (Jan 2017)
Summary:	TrueConf is prone to multiple vulnerabilities.
Description:	Summary: TrueConf is prone to multiple vulnerabilities. Vulnerability Insight: TrueConf is prone to multiple vulnerabilities: - The administration interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. - Input passed via the 'redirect_url' GET parameter is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. - TrueConf also suffers from multiple stored, reflected and DOM XSS issues when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Affected Software/OS: TrueConf version 4.3.7.12255 and 4.3.7.12219. Solution: Update to version 4.3.8 or later. CVSS Score: 4.0 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.