CVE-2011-5178

Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) eulaAccepted or (2) mode parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.infoblox.com/community/downloads/hotfix-v602-netmri-8831gpg	Vendor Advisory
http://www.infoblox.com/community/downloads/hotfix-v612-netmri-8831gpg	Vendor Advisory
http://seclists.org/fulldisclosure/2011/Nov/158	Exploit
http://secunia.com/advisories/46854	Vendor Advisory
http://www.infoblox.com/community/downloads/hotfix-v621-netmri-8831gpg	Vendor Advisory
http://foregroundsecurity.com/secure-coding-and-security-qa/111-infoblox-netmri-621-612-and-60242-multiple-cross-site-scripting-xss	Exploit
http://www.securitytracker.com/id?1026319	Exploit

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:infoblox:netmri:6.0.2.42:::::::*
	cpe:2.3:a:infoblox:netmri:6.1.2:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:infoblox:netmri::::::::
	cpe:2.3:a:infoblox:netmri:6.2.1.48:::::::*

Information

Published : 2012-09-20 03:55

Updated : 2012-12-16 21:00

NVD link : CVE-2011-5178

Mitre link : CVE-2011-5178

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

infoblox

netmri

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.infoblox.com/community/downloads/hotfix-v602-netmri-8831gpg", "name": "http://www.infoblox.com/community/downloads/hotfix-v602-netmri-8831gpg", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.infoblox.com/community/downloads/hotfix-v612-netmri-8831gpg", "name": "http://www.infoblox.com/community/downloads/hotfix-v612-netmri-8831gpg", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://seclists.org/fulldisclosure/2011/Nov/158", "name": "20111110 [FOREGROUND SECURITY 2011-004] Infoblox NetMRI 6.2.1 Multiple Cross-Site Scripting (XSS) vulnerabilities", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "http://secunia.com/advisories/46854", "name": "46854", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.infoblox.com/community/downloads/hotfix-v621-netmri-8831gpg", "name": "http://www.infoblox.com/community/downloads/hotfix-v621-netmri-8831gpg", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://foregroundsecurity.com/secure-coding-and-security-qa/111-infoblox-netmri-621-612-and-60242-multiple-cross-site-scripting-xss", "name": "http://foregroundsecurity.com/secure-coding-and-security-qa/111-infoblox-netmri-621-612-and-60242-multiple-cross-site-scripting-xss", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securitytracker.com/id?1026319", "name": "1026319", "tags": ["Exploit"], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) eulaAccepted or (2) mode parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-5178", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2012-09-20T10:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:infoblox:netmri:6.0.2.42:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:infoblox:netmri:6.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.2.1"}, {"cpe23Uri": "cpe:2.3:a:infoblox:netmri:6.2.1.48:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2012-12-17T05:00Z"}