CVE-2008-2165

Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/29191
http://securitytracker.com/id?1020018
http://secunia.com/advisories/30222	Vendor Advisory
http://securityreason.com/securityalert/3895
http://www.vupen.com/english/advisories/2008/1535
https://exchange.xforce.ibmcloud.com/vulnerabilities/42395
http://www.securityfocus.com/archive/1/492093/100/0/threaded
http://www.securityfocus.com/archive/1/492043/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:building_broadband_service_manager:5.3:*:*:*:*:*:*:*

Information

Published : 2008-05-16 05:54

Updated : 2018-10-11 13:39

NVD link : CVE-2008-2165

Mitre link : CVE-2008-2165

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

cisco

building_broadband_service_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/29191", "name": "29191", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1020018", "name": "1020018", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/30222", "name": "30222", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/3895", "name": "3895", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2008/1535", "name": "ADV-2008-1535", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42395", "name": "cisco-bbsm-accesscodestart-xss(42395)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/492093/100/0/threaded", "name": "20080514 Re: Cisco BBSM Captive Portal Cross-site Scripting", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/492043/100/0/threaded", "name": "20080513 Cisco BBSM Captive Portal Cross-site Scripting", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-2165", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2008-05-16T12:54Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:building_broadband_service_manager:5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-11T20:39Z"}