PT-2011-2255 · Blackberry · Blackberry Enterprise Server+2

Published 2011-04-18 · Updated 2011-04-18 · CVE-2011-0286

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Server software versions prior to 5.0.2 MR5 BlackBerry Enterprise Server software versions prior to 5.0.3 MR1 BlackBerry Enterprise Server Express software version 5.0.1 BlackBerry Enterprise Server Express software version 5.0.2

Description A cross-site scripting (XSS) issue exists in the webdesktop/app component of the BlackBerry Web Desktop Manager. This allows remote attackers to inject arbitrary web script or HTML via the displayErrorMessage parameter in a "ManageDevices" action.

Recommendations For BlackBerry Enterprise Server software versions prior to 5.0.2 MR5, update to version 5.0.2 MR5 or later. For BlackBerry Enterprise Server software versions prior to 5.0.3 MR1, update to version 5.0.3 MR1 or later. For BlackBerry Enterprise Server Express software version 5.0.1, update to a newer version. For BlackBerry Enterprise Server Express software version 5.0.2, update to a newer version.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-0286

Affected Products

Blackberry Enterprise Server

Blackberry Enterprise Server Express

Blackberry Desktop Manager

References · 8

• 🔥 http://cybsec.com/vuln/CYBSEC_Advisory_2011_0401_Cross_Site_Scripting_XSS_in_Blackberry_WebDesktop.pdf · Exploit
• http://vupen.com/english/advisories/2011/0971 · Vendor Advisory
• http://secunia.com/advisories/44183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0286 · Security Note
• http://blackberry.com/btsc/KB26296 · Vendor Advisory
• http://securityfocus.com/bid/47324 · Note
• http://blackberry.com/btsc/KB25966 · Note
• http://securitytracker.com/id?1025356 · Note