CVE-2007-5472

Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp	Patch
http://secunia.com/advisories/27301	Patch Vendor Advisory
http://www.securityfocus.com/bid/26134
http://securitytracker.com/id?1018839
http://osvdb.org/37998
http://www.vupen.com/english/advisories/2007/3547
https://exchange.xforce.ibmcloud.com/vulnerabilities/37285
http://www.securityfocus.com/archive/1/482536/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:broadcom:host-based_intrusion_prevention_system:*:*:*:*:*:*:*:*

Information

Published : 2007-10-22 12:46

Updated : 2021-04-09 09:52

NVD link : CVE-2007-5472

Mitre link : CVE-2007-5472

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

broadcom

host-based_intrusion_prevention_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp", "name": "http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/27301", "name": "27301", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/26134", "name": "26134", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1018839", "name": "1018839", "tags": [], "refsource": "SECTRACK"}, {"url": "http://osvdb.org/37998", "name": "37998", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/3547", "name": "ADV-2007-3547", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37285", "name": "ca-hips-log-xss(37285)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/482536/100/0/threaded", "name": "20071019 [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-5472", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2007-10-22T19:46Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:broadcom:host-based_intrusion_prevention_system:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-04-09T16:52Z"}