VAR-201105-0049
Vulnerability from variot - Updated: 2024-02-14 22:47Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712. The problem is Bug ID CSCto12712 It is a problem.Any third party, through the tag parameters, Web Script or HTML May be inserted. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue is being tracked by Cisco Bug ID CSCto12712. Sense of Security - Security Advisory - SOS-11-006
Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Platform. Microsoft Windows Affected versions. CuOM 8.0 and 8.5 (verified), possibly others. Severity Rating. Medium - Low Impact. Database access, cookie and credential theft, impersonation, loss of confidentiality, local file disclosure, information disclosure. Attack Vector. Remote with authentication Solution Status. Vendor patch (upgrade to CuOM 8.6 as advised by Cisco) CVE reference. CVE-2011-0959 (CSCtn61716) CVE-2011-0960 (CSCtn61716) CVE-2011-0961 (CSCto12704) CVE-2011-0962 (CSCto12712) CVE-2011-0966 (CSCto35577)
Details. Operations Manager monitors and evaluates the current status of both the IP communications infrastructure and the underlying transport infrastructure in your network. These vulnerabilities include multiple blind SQL injections, multiple XSS. and a directory traversal vulnerability.
- Blind SQL injection vulnerabilities that affect CuOM CVE-2011-0960 (CSCtn61716): The Variable CCMs of PRTestCreation can trigger a blind SQL injection vulnerability by supplying a single quote, followed by a time delay call: /iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20 delay'0:0:20'--&Extns=&IPs=
Additionally, variable ccm of TelePresenceReportAction can trigger a blind SQL injection vulnerability by supplying a single quote: /iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'--
- Directory traversal vulnerability that affects CiscoWorks Homepage CVE-2011-0966 (CSCto35577): http://target:1741/cwhp/auditLog.do?file=..............\boot.ini cmfDBA user database info: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope rties DB connection info for all databases: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper ties Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example. DB password change log: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\log\dbpwdChange.log Solution. Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and CSCto35577 for information on patches and availability of fixes.
Discovered by. Sense of Security Labs.
About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the countries largest organisations.
Sense of Security Pty Ltd Level 8, 66 King St Sydney NSW 2000 AUSTRALIA
T: +61 (0)2 9290 4444 F: +61 (0)2 9290 4455 W: http://www.senseofsecurity.com.au E: info@senseofsecurity.com.au Twitter: @ITsecurityAU
The latest version of this advisory can be found at: http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php . ----------------------------------------------------------------------
http://twitter.com/secunia
http://www.facebook.com/Secunia
TITLE: Cisco Unified Operations Manager Cross-Site Scripting and SQL Injection Vulnerabilities
SECUNIA ADVISORY ID: SA44597
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44597/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44597
RELEASE DATE: 2011-05-20
DISCUSS ADVISORY: http://secunia.com/advisories/44597/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44597/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44597
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Some vulnerabilities have been reported in Cisco Unified Operations Manager, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.
1) Input passed via the "CCMs" parameter to iptm/PRTestCreation.do and the "ccm" parameter to iptm/TelePresenceReportAction.do is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) Input passed via various parameters to multiple scripts is not properly sanitised before being returned to the user.
Examples: http://[host]/iptm/advancedfind.do?extn=[code] http://[host]/iptm/ddv.do?deviceCapability=deviceCap&deviceInstanceName=[code] http://[host]/iptm/eventmon?viewname=device.filter&operation=getFilter&cmd=[code] http://[host]/iptm/eventmon?cmd=getDeviceData&group=[code] http://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?clusterName=[code] http://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?deviceName=[code] http://[host]/iptm/logicalTopo.do?ccmName=[code] http://[host]/iptm/logicalTopo.do?clusterName=[code]
3) Input passed via the "tag" parameter to CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in Common Services Device Center is not properly sanitised before being returned to the user.
The vulnerabilities are reported in versions 8.0 and 8.5.
SOLUTION: Updated to version 8.6.
PROVIDED AND/OR DISCOVERED BY: Sense of Security Labs
ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=23085 http://tools.cisco.com/security/center/viewAlert.x?alertId=23086 http://tools.cisco.com/security/center/viewAlert.x?alertId=23087
Sense of Security Labs: http://www.senseofsecurity.com.au/advisories/SOS-11-006
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201105-0049",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.1"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.2"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.3"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "8.0"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.0.1"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.0.2"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 2.5,
"vendor": "cisco",
"version": "2.0.3"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.0"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "1.1"
},
{
"model": "unified operations manager",
"scope": "eq",
"trust": 1.5,
"vendor": "cisco",
"version": "8.5"
},
{
"model": "unified operations manager",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "8.5"
},
{
"model": "unified operations manager sp1",
"scope": "eq",
"trust": 0.9,
"vendor": "cisco",
"version": "2.1"
},
{
"model": "unified operations manager",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.6"
},
{
"model": "unified operations manager",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "8.6"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "BID",
"id": "47903"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:unified_operations_manager:2.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sense of Security Labs.",
"sources": [
{
"db": "BID",
"id": "47903"
}
],
"trust": 0.3
},
"cve": "CVE-2011-0962",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-0962",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-48907",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-0962",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201105-208",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-48907",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712. The problem is Bug ID CSCto12712 It is a problem.Any third party, through the tag parameters, Web Script or HTML May be inserted. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. \nThis issue is being tracked by Cisco Bug ID CSCto12712. Sense of Security - Security Advisory - SOS-11-006\n\nRelease Date. 18-May-2011\nLast Update. -\nVendor Notification Date. 28-Feb-2011\nProduct. \nPlatform. Microsoft Windows\nAffected versions. CuOM 8.0 and 8.5 (verified),\n possibly others. \nSeverity Rating. Medium - Low\nImpact. Database access, cookie and credential\n theft, impersonation, loss of\n confidentiality, local file disclosure,\n information disclosure. \nAttack Vector. Remote with authentication\nSolution Status. Vendor patch (upgrade to CuOM 8.6 as\n advised by Cisco)\nCVE reference. CVE-2011-0959 (CSCtn61716)\n CVE-2011-0960 (CSCtn61716)\n CVE-2011-0961 (CSCto12704)\n CVE-2011-0962 (CSCto12712)\n CVE-2011-0966 (CSCto35577)\n\nDetails. Operations Manager monitors and evaluates the current\nstatus of both the IP communications infrastructure and the underlying\ntransport infrastructure in your network. These vulnerabilities\ninclude multiple blind SQL injections, multiple XSS. and a directory\ntraversal vulnerability. \n\n1. Blind SQL injection vulnerabilities that affect CuOM\nCVE-2011-0960 (CSCtn61716):\nThe Variable CCMs of PRTestCreation can trigger a blind SQL injection\nvulnerability by supplying a single quote, followed by a time delay\ncall:\n/iptm/PRTestCreation.do?RequestSource=dashboard\u0026MACs=\u0026CCMs=\u0027waitfor%20\ndelay\u00270:0:20\u0027--\u0026Extns=\u0026IPs=\n\nAdditionally, variable ccm of TelePresenceReportAction can trigger a\nblind SQL injection vulnerability by supplying a single quote:\n/iptm/TelePresenceReportAction.do?ccm=\u0027waitfor%20delay\u00270:0:20\u0027--\n\n2. Directory traversal vulnerability that affects CiscoWorks Homepage\nCVE-2011-0966 (CSCto35577):\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini\ncmfDBA user database info:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.prope\nrties\nDB connection info for all databases:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.proper\nties\nNote: When reading large files such as this file, ensure the row\nlimit is adjusted to 500 for example. \nDB password change log:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\log\\dbpwdChange.log\nSolution. \nUpgrade to CuOM 8.6. \nRefer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and\nCSCto35577 for information on patches and availability of fixes. \n\nDiscovered by. \nSense of Security Labs. \n\nAbout us. \nSense of Security is a leading provider of information\nsecurity and risk management solutions. Our team has expert\nskills in assessment and assurance, strategy and architecture,\nand deployment through to ongoing management. We are\nAustralia\u0027s premier application penetration testing firm and\ntrusted IT security advisor to many of the countries largest\norganisations. \n\nSense of Security Pty Ltd \nLevel 8, 66 King St\nSydney NSW 2000\nAUSTRALIA\n\nT: +61 (0)2 9290 4444\nF: +61 (0)2 9290 4455\nW: http://www.senseofsecurity.com.au\nE: info@senseofsecurity.com.au\nTwitter: @ITsecurityAU\n\nThe latest version of this advisory can be found at:\nhttp://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf\n\nOther Sense of Security advisories can be found at:\nhttp://www.senseofsecurity.com.au/research/it-security-advisories.php\n. ----------------------------------------------------------------------\n\n\nhttp://twitter.com/secunia\n\nhttp://www.facebook.com/Secunia\n\n\n----------------------------------------------------------------------\n\nTITLE:\nCisco Unified Operations Manager Cross-Site Scripting and SQL\nInjection Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA44597\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44597/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44597\n\nRELEASE DATE:\n2011-05-20\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44597/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44597/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44597\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Cisco Unified Operations\nManager, which can be exploited by malicious people to conduct\ncross-site scripting and SQL injection attacks. \n\n1) Input passed via the \"CCMs\" parameter to iptm/PRTestCreation.do\nand the \"ccm\" parameter to iptm/TelePresenceReportAction.do is not\nproperly sanitised before being used in SQL queries. This can be\nexploited to manipulate SQL queries by injecting arbitrary SQL code. \n\n2) Input passed via various parameters to multiple scripts is not\nproperly sanitised before being returned to the user. \n\nExamples:\nhttp://[host]/iptm/advancedfind.do?extn=[code]\nhttp://[host]/iptm/ddv.do?deviceCapability=deviceCap\u0026deviceInstanceName=[code]\nhttp://[host]/iptm/eventmon?viewname=device.filter\u0026operation=getFilter\u0026cmd=[code]\nhttp://[host]/iptm/eventmon?cmd=getDeviceData\u0026group=[code]\nhttp://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?clusterName=[code]\nhttp://[host]/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?deviceName=[code]\nhttp://[host]/iptm/logicalTopo.do?ccmName=[code]\nhttp://[host]/iptm/logicalTopo.do?clusterName=[code]\n\n3) Input passed via the \"tag\" parameter to\nCSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in Common Services\nDevice Center is not properly sanitised before being returned to the\nuser. \n\nThe vulnerabilities are reported in versions 8.0 and 8.5. \n\nSOLUTION:\nUpdated to version 8.6. \n\nPROVIDED AND/OR DISCOVERED BY:\nSense of Security Labs\n\nORIGINAL ADVISORY:\nCisco:\nhttp://tools.cisco.com/security/center/viewAlert.x?alertId=23085\nhttp://tools.cisco.com/security/center/viewAlert.x?alertId=23086\nhttp://tools.cisco.com/security/center/viewAlert.x?alertId=23087\n\nSense of Security Labs:\nhttp://www.senseofsecurity.com.au/advisories/SOS-11-006\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0962"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "BID",
"id": "47903"
},
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "PACKETSTORM",
"id": "101570"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-48907",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48907"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-0962",
"trust": 3.5
},
{
"db": "EXPLOIT-DB",
"id": "17304",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "44597",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-1911",
"trust": 0.6
},
{
"db": "XF",
"id": "67524",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20110518 CISCO UNIFIED OPERATIONS MANAGER MULTIPLE VULNERABILITIES - SOS-11-006",
"trust": 0.6
},
{
"db": "BID",
"id": "47903",
"trust": 0.4
},
{
"db": "EXPLOIT-DB",
"id": "35780",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-48907",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101518",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101570",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "BID",
"id": "47903"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "PACKETSTORM",
"id": "101570"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"id": "VAR-201105-0049",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "VULHUB",
"id": "VHN-48907"
}
],
"trust": 1.3875
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
}
]
},
"last_update_date": "2024-02-14T22:47:00.371000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "23087",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23087"
},
{
"title": "Patch for Cisco Unified Operations Manager Common Services Device Center Cross-Site Scripting Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/3889"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23087"
},
{
"trust": 1.8,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/17304"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67524"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0962"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0962"
},
{
"trust": 0.6,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006.pdfhttp"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/67524"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/44597"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/products/ps6535/index.html"
},
{
"trust": 0.3,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf "
},
{
"trust": 0.1,
"url": "http://target:1741/cwhp/auditlog.do?file=..\\..\\..\\..\\..\\..\\..\\program"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0961"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0960"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au/research/it-security-advisories.php"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0962"
},
{
"trust": 0.1,
"url": "http://target:1741/cwhp/auditlog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0966"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0959"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44597"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/faultmon/ui/dojo/main/eventmon_wrapper.jsp?clustername=[code]"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44597/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/logicaltopo.do?clustername=[code]"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/ddv.do?devicecapability=devicecap\u0026deviceinstancename=[code]"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44597/#comments"
},
{
"trust": 0.1,
"url": "http://twitter.com/secunia"
},
{
"trust": 0.1,
"url": "http://www.facebook.com/secunia"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/advancedfind.do?extn=[code]"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23085"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/eventmon?viewname=device.filter\u0026operation=getfilter\u0026cmd=[code]"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/logicaltopo.do?ccmname=[code]"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23086"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/eventmon?cmd=getdevicedata\u0026group=[code]"
},
{
"trust": 0.1,
"url": "http://[host]/iptm/faultmon/ui/dojo/main/eventmon_wrapper.jsp?devicename=[code]"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "BID",
"id": "47903"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "PACKETSTORM",
"id": "101570"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"db": "VULHUB",
"id": "VHN-48907"
},
{
"db": "BID",
"id": "47903"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "PACKETSTORM",
"id": "101570"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-05-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"date": "2011-05-20T00:00:00",
"db": "VULHUB",
"id": "VHN-48907"
},
{
"date": "2011-05-18T00:00:00",
"db": "BID",
"id": "47903"
},
{
"date": "2011-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"date": "2011-05-18T14:17:13",
"db": "PACKETSTORM",
"id": "101518"
},
{
"date": "2011-05-20T05:48:10",
"db": "PACKETSTORM",
"id": "101570"
},
{
"date": "2011-05-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"date": "2011-05-20T22:55:03.033000",
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-05-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-1911"
},
{
"date": "2017-08-17T00:00:00",
"db": "VULHUB",
"id": "VHN-48907"
},
{
"date": "2011-05-18T00:00:00",
"db": "BID",
"id": "47903"
},
{
"date": "2011-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003130"
},
{
"date": "2011-05-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-208"
},
{
"date": "2024-02-14T01:17:43.863000",
"db": "NVD",
"id": "CVE-2011-0962"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Unified Operations Manager Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003130"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201105-208"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…