{}

Nos marques

{"support":{"yesButton":"Oui","noButton":"Non","feedback":{"title":"Quelles améliorations pouvons-nous apporter ?"},"submitButton":"Soumettre","successMessage":"Merci de nous avoir fait part de vos commentaires.","title":"Cela vous a-t-il été utile ?","feedbackPercentLabel":"personnes ont trouvé cela utile","captcha":{"error":"Veuillez cocher la case appropriée."}}}

Consulter notre FAQ

{"searchBar":{"inputPlaceholder":"Rechercher par mot-clé ou poser une question","searchBtn":"Rechercher","error":"Veuillez saisir un mot-clé pour effectuer une recherche"}}

Is PowerChute Network Shutdown vulnerable to Cross Site Tracing (XST)?

Issue:
Is PowerChute Network Shutdown vulnerable to Cross Site Tracing (XST)?

Product:
PowerChute Network Shutdown

Environment:
All support OS

Cause:
Jetty web server

Solution:

The PCNS application is hosted on a Jetty Web Server. By default Jetty appears to have the HTTP TRACE method enabled.

In earlier versions of PowerChute (prior to 4.0), in response to an HTTP OPTIONS request the Jetty Web Server lists TRACE as an available option. However the TRACE method is blocked by the PCNS application.

HTTP/1.1 405 Method Not Allowed is sent in response to any TRACE request. Therefore PCNS is not vulnerable to CrossSite Tracing.

Cross site tracing (XST) is a vulnerability exploiting the HTTP TRACE method.
Further information can be found here:

http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf

Vous ne trouvez pas ce que vous recherchez ?

Contactez notre service client local si vous avez des questions ou si vous avez besoin de plus de détails ou d'une assistance technique.