PT-2014-5072 · Ibm · Ibm Gcm16+1

Published 2014-08-17 · Updated 2017-08-29 · CVE-2014-3080

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The affected API endpoints include "kvm.cgi" and "avctalert.php", with vulnerable parameters being the query string to "kvm.cgi" and the key parameter to "avctalert.php".

Recommendations For IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447, update the firmware to version 1.20.20.23447 or later to resolve the issue. As a temporary workaround, consider restricting access to the "kvm.cgi" and "avctalert.php" endpoints to minimize the risk of exploitation. Avoid using the key parameter in the "avctalert.php" endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3080

Affected Products

Ibm Gcm16

Ibm Gcm32

References · 8

• 🔥 http://exploit-db.com/exploits/34132 · Exploit
• 🔥 http://securityfocus.com/bid/68777 · Exploit
• 🔥 https://exploit-db.com/exploits/34132 · Exploit
• http://ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3080 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93929 · Note
• http://seclists.org/fulldisclosure/2014/Jul/113 · Note
• http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html · Note