CVE-2010-2103

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/64844	Exploit
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03	Exploit
http://www.exploit-db.com/exploits/12689	Exploit
http://www.vupen.com/english/advisories/2010/1215	Vendor Advisory
http://www.securityfocus.com/bid/40327	Exploit
http://secunia.com/advisories/39906	Vendor Advisory
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf
https://kb.juniper.net/KB27373
https://exchange.xforce.ibmcloud.com/vulnerabilities/58790
http://www.securityfocus.com/archive/1/511404/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:apache:axis2:1.4.1:::::::*
	cpe:2.3:a:apache:axis2:1.5.1:::::::*

OR	cpe:2.3:a:3com:intelligent_management_center::::::::
	cpe:2.3:a:sap:business_objects:12:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:apache:axis2:1.4.1:::::::*
	cpe:2.3:a:apache:axis2:1.5.1:::::::*

Information

Published : 2010-05-27 15:30

Updated : 2018-10-10 12:58

NVD link : CVE-2010-2103

Mitre link : CVE-2010-2103

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

apache

axis2

sap

business_objects

3com

intelligent_management_center

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://osvdb.org/64844", "name": "64844", "tags": ["Exploit"], "refsource": "OSVDB"}, {"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03", "name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.exploit-db.com/exploits/12689", "name": "12689", "tags": ["Exploit"], "refsource": "EXPLOIT-DB"}, {"url": "http://www.vupen.com/english/advisories/2010/1215", "name": "ADV-2010-1215", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/bid/40327", "name": "40327", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/39906", "name": "39906", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf", "name": "http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf", "tags": [], "refsource": "MISC"}, {"url": "https://kb.juniper.net/KB27373", "name": "https://kb.juniper.net/KB27373", "tags": [], "refsource": "CONFIRM"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58790", "name": "axis2-modules-xss(58790)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/511404/100/0/threaded", "name": "20100521 PR10-03: Authenticated Cross-Site Scripting (XSS) within the Apache Axis2 administration console", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-2103", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2010-05-27T22:30Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:axis2:1.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:axis2:1.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:3com:intelligent_management_center:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:a:sap:business_objects:12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:axis2:1.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:axis2:1.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-10T19:58Z"}