PT-2011-2777 · Cisco · Cisco Unified Operations Manager

Published

2011-05-20

·

Updated

2024-02-14

·

CVE-2011-0959

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Cisco Unified Operations Manager versions prior to 8.6
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including extn in the "/iptm/advancedfind.do" endpoint, deviceInstanceName in the "/iptm/ddv.do" endpoint, cmd or group in the "/iptm/eventmon" endpoint, clusterName or deviceName in the "/iptm/faultmon/ui/dojo/Main/eventmon wrapper.jsp" endpoint, and ccmName or clusterName in the "/iptm/logicalTopo.do" endpoint.
Recommendations For versions prior to 8.6, update to version 8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "/iptm/advancedfind.do", "/iptm/ddv.do", "/iptm/eventmon", "/iptm/faultmon/ui/dojo/Main/eventmon wrapper.jsp", and "/iptm/logicalTopo.do", to minimize the risk of exploitation. Avoid using the vulnerable parameters extn, deviceInstanceName, cmd, group, clusterName, deviceName, ccmName, and clusterName in the respective endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-0959

Affected Products

Cisco Unified Operations Manager