CVE-2010-0152

{"id": "CVE-2010-0152", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-09-14T17:00:01.337", "references": [{"url": "http://www.securityfocus.com/archive/1/513629/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.ventuneac.net/security-advisories/MVSA-10-007", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/513629/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ventuneac.net/security-advisories/MVSA-10-007", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via (1) the date1 parameter to pvm_messagestore.php, (2) the userfilter parameter to pvm_user_management.php, (3) the ping parameter to sys_tools.php in a sys_ping.php action, (4) the action parameter to pvm_cert_commaction.php, (5) the action parameter to pvm_cert_serveraction.php, (6) the action parameter to pvm_smtpstore.php, (7) the l parameter to sla/index.php, or (8) unspecified stored data; and allow remote authenticated users to inject arbitrary web script or HTML via (9) saved search filters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Local Management Interface (LMI) en el dispositivo IBM Proventia Network Mail Security System (PNMSS), con firmware anterior a la versi\u00f3n 2.5.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante (1) el par\u00e1metro date1 para pvm_messagestore.php, (2) el par\u00e1metro userfilter para pvm_user_management.php, (3) el par\u00e1metro ping para sys_tools.php en una acci\u00f3n sys_ping.php, (4) el par\u00e1metro action para pvm_cert_commaction.php, (5) el par\u00e1metro action para pvm_cert_serveraction.php, (6) el par\u00e1metro action para pvm_smtpstore.php, (7) el par\u00e1metro l para sla/index.php o (8) datos almacenados no especificados; y permitir a atacantes remotos autenticados inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante (9) filtros de b\u00fasqueda almacenados."}], "lastModified": "2024-11-21T01:11:38.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4AE7B81-387C-446B-B5EF-B897C39D15A1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance_firmware:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A62936-C40C-40DF-8222-ABD6D287CAC5"}, {"criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance_firmware:2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD8E872B-083C-4732-8AED-A69C0B55E7CB"}], "operator": "OR"}], "operator": "AND"}], "evaluatorImpact": "Per: http://www.ventuneac.net/security-advisories/MVSA-10-007\r\n\r\nAffected Versions\r\n\r\nIBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)\r\nIBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)", "sourceIdentifier": "cve@mitre.org"}