PT-2007-6603 · Cisco · Ciscoworks Common Services+1

Publicado 2007-12-15 · Atualizado 2018-10-15 · CVE-2007-5582

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco CiscoWorks Server (CS) versions 2.6 and earlier CiscoWorks Common Services versions 3.0.x and 3.1

Description A cross-site scripting (XSS) issue exists in the login page, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized access or control of user sessions.

Recommendations For Cisco CiscoWorks Server (CS) versions 2.6 and earlier, update to a version later than 2.6 to resolve the issue. For CiscoWorks Common Services versions 3.0.x and 3.1, consider disabling the login page functionality until a patch is available. As a temporary workaround, restrict access to the login page to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5582

Produtos afetados

Ciscoworks Common Services

Ciscoworks Server

Referências · 11

• http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5582 · Nota de Segurança
• http://securityfocus.com/bid/26708 · Nota
• http://securitytracker.com/id?1019043 · Nota
• http://vupen.com/english/advisories/2007/4102 · Nota
• http://liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks · Nota
• http://cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml · Correção, Aviso do Fabricante
• http://securityreason.com/securityalert/3449 · Nota
• http://secunia.com/advisories/27902 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38862 · Nota
• http://securityfocus.com/archive/1/484609/100/0/threaded · Nota