CVE Feed

    Dashboard / CVE / CVE-2011-2159

    CVE-2011-2159

    The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/Defaults/frmDefaultSiteSettings.aspx, (2) Admin/Defaults/frmServerDefaults.aspx, (3) Admin/frmReportSettings.aspx, (4) Admin/frmSite.aspx, (5) App_Themes/Default/ButtonBarIcons.xml, (6) App_Themes/Default/Skin.xml, (7) Client/frmImportSettings.aspx, (8) Client/frmSeoSettings.aspx, (9) Services/Web.config, (10) aspnet_client/system_web/4_0_30319/, (11) clientaccesspolicy.xml, (12) cloudscan.exe, (13) crossdomain.xml, or (14) sitemap.xml. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.

    Published:May 20, 2011
    Last Modified:Apr 11, 2025
    EPS:May 20, 2011
    EPSS Score:0.02301
    CVSS Score:10

    Affected Products

    Vendor
    Smartertools
    Product
    Smarterstats

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2017-14620 (CVSS 6.1) — SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/Referring…
    CVE-2011-4750 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attacke…
    CVE-2011-4752 (CVSS 10) — SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might all…
    CVE-2011-4751 (CVSS 5) — SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests w…
    CVE-2011-2157 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools…
    CVE-2011-2150 (CVSS 5) — The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for stora…
    CVE-2011-2153 (CVSS 5) — Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parame…
    CVE-2011-2148 (CVSS 10) — Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrar…
    CVE-2011-2151 (CVSS 5) — The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Clie…
    CVE-2011-2152 (CVSS 5) — The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High