CVE-2006-3101

Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/en/US/products/sw/secursw/ps4911/tsd_products_security_response09186a00806b8bdb.html	Patch
http://www.securityfocus.com/bid/18449	Exploit Patch
http://securitytracker.com/id?1016317	Exploit Patch
http://secunia.com/advisories/20699	Patch Vendor Advisory
http://www.osvdb.org/26531
http://securityreason.com/securityalert/1116
http://www.vupen.com/english/advisories/2006/2384
https://exchange.xforce.ibmcloud.com/vulnerabilities/27166
http://www.securityfocus.com/archive/1/437480/100/0/threaded
http://www.securityfocus.com/archive/1/437441/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:secure_access_control_server:2.3:*:unix:*:*:*:*:*

Information

Published : 2006-06-20 18:02

Updated : 2018-10-18 09:45

NVD link : CVE-2006-3101

Mitre link : CVE-2006-3101

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

cisco

secure_access_control_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cisco.com/en/US/products/sw/secursw/ps4911/tsd_products_security_response09186a00806b8bdb.html", "name": "20060615 Cisco Secure ACS for UNIX Cross Site Scripting Vulnerability", "tags": ["Patch"], "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/18449", "name": "18449", "tags": ["Exploit", "Patch"], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1016317", "name": "1016317", "tags": ["Exploit", "Patch"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/20699", "name": "20699", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/26531", "name": "26531", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/1116", "name": "1116", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/2384", "name": "ADV-2006-2384", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27166", "name": "cisco-acs-logonproxy-xss(27166)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/437480/100/0/threaded", "name": "20060617 RE: Cisco Secure ACS Cross Site Scripting Vulnerability.", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/437441/100/0/threaded", "name": "20060615 Cisco Secure ACS Cross Site Scripting Vulnerability.", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3101", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-06-21T01:02Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:secure_access_control_server:2.3:*:unix:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:45Z"}