PT-2011-2255 · Blackberry · Blackberry Enterprise Server+2

Publicado 2011-04-18 · Atualizado 2011-04-18 · CVE-2011-0286

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Server software versions prior to 5.0.2 MR5 BlackBerry Enterprise Server software versions prior to 5.0.3 MR1 BlackBerry Enterprise Server Express software version 5.0.1 BlackBerry Enterprise Server Express software version 5.0.2

Description A cross-site scripting (XSS) issue exists in the webdesktop/app component of the BlackBerry Web Desktop Manager. This allows remote attackers to inject arbitrary web script or HTML via the displayErrorMessage parameter in a "ManageDevices" action.

Recommendations For BlackBerry Enterprise Server software versions prior to 5.0.2 MR5, update to version 5.0.2 MR5 or later. For BlackBerry Enterprise Server software versions prior to 5.0.3 MR1, update to version 5.0.3 MR1 or later. For BlackBerry Enterprise Server Express software version 5.0.1, update to a newer version. For BlackBerry Enterprise Server Express software version 5.0.2, update to a newer version.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-0286

Produtos afetados

Blackberry Enterprise Server

Blackberry Enterprise Server Express

Blackberry Desktop Manager

Referências · 8

• 🔥 http://cybsec.com/vuln/CYBSEC_Advisory_2011_0401_Cross_Site_Scripting_XSS_in_Blackberry_WebDesktop.pdf · Exploit
• http://vupen.com/english/advisories/2011/0971 · Aviso do Fabricante
• http://securityfocus.com/bid/47324 · Nota
• http://secunia.com/advisories/44183 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0286 · Nota de Segurança
• http://blackberry.com/btsc/KB25966 · Nota
• http://blackberry.com/btsc/KB26296 · Aviso do Fabricante
• http://securitytracker.com/id?1025356 · Nota