CVE-2010-2288

Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id?1024090
http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-05-751&viewMode=view
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-17	Exploit
http://osvdb.org/65288
http://www.securityfocus.com/archive/1/511775/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:juniper:secure_access:6.5:r1.0::::::
	cpe:2.3:a:juniper:secure_access:6.5:r2.0::::::

Information

Published : 2010-06-15 07:04

Updated : 2018-10-10 12:59

NVD link : CVE-2010-2288

Mitre link : CVE-2010-2288

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Products Affected

juniper

secure_access

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securitytracker.com/id?1024090", "name": "1024090", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-05-751&viewMode=view", "name": "http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-05-751&viewMode=view", "tags": [], "refsource": "MISC"}, {"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-17", "name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-17", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://osvdb.org/65288", "name": "65288", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/archive/1/511775/100/0/threaded", "name": "20100610 PR09-17: Juniper Secure Access seriers (Juniper IVE) authenticated XSS & REDIRECTION", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-2288", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2010-06-15T14:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:juniper:secure_access:6.5:r1.0:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:juniper:secure_access:6.5:r2.0:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-10T19:59Z"}

4.3 /10