PT-2023-10189 · Opendns · Opendns Openresolve

Published 2023-01-02 · Updated 2024-05-17 · CVE-2015-10010

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenDNS OpenResolve (affected versions not specified)

Description A problem was found in OpenDNS OpenResolve, related to the function get of the file resolverapi/endpoints.py of the component API. This issue leads to cross site scripting. The attack can be launched remotely, but the complexity of an attack is rather high and the exploitation is known to be difficult.

Recommendations To fix this issue, it is recommended to apply a patch. Specifically, the patch c680170d5583cd9342fe1af43001fe8b2b8004dd should be applied. As a temporary workaround, consider disabling the get function of the resolverapi/endpoints.py file until the patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10010

Affected Products

Opendns Openresolve

References · 5

• https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10010 · Security Note
• https://t.me/cibsecurity/55774 · Telegram Post
• https://vuldb.com/?ctiid.217196 · Note
• https://vuldb.com/?id.217196 · Note