PT-2011-2777 · Cisco · Cisco Unified Operations Manager
CVE-2011-0959
·
Publicado
2011-05-20
·
Atualizado
2024-02-14
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Operations Manager versions prior to 8.6
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including
extn in the "/iptm/advancedfind.do" endpoint, deviceInstanceName in the "/iptm/ddv.do" endpoint, cmd or group in the "/iptm/eventmon" endpoint, clusterName or deviceName in the "/iptm/faultmon/ui/dojo/Main/eventmon wrapper.jsp" endpoint, and ccmName or clusterName in the "/iptm/logicalTopo.do" endpoint.Recommendations
For versions prior to 8.6, update to version 8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "/iptm/advancedfind.do", "/iptm/ddv.do", "/iptm/eventmon", "/iptm/faultmon/ui/dojo/Main/eventmon wrapper.jsp", and "/iptm/logicalTopo.do", to minimize the risk of exploitation. Avoid using the vulnerable parameters
extn, deviceInstanceName, cmd, group, clusterName, deviceName, ccmName, and clusterName in the respective endpoints until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Unified Operations Manager