CVE-2010-4275

Multiple cross-site scripting (XSS) vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) name or (2) descr parameter in an (a) update_usergroup or a (b) store_nas action to admin.php.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/42364	Vendor Advisory
http://www.exploit-db.com/exploits/15766
http://www.securityfocus.com/bid/45481	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/64199
http://secunia.com/advisories/42364	Vendor Advisory
http://www.exploit-db.com/exploits/15766
http://www.securityfocus.com/bid/45481	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/64199

Configurations

Configuration 1 (hide)

cpe:2.3:a:dmasoftlab:radius_manager:3.8.0:*:*:*:*:*:*:*

History

21 Nov 2024, 01:20

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/42364 - Vendor Advisory~~	() http://secunia.com/advisories/42364 - Vendor Advisory
References	~~() http://www.exploit-db.com/exploits/15766 -~~	() http://www.exploit-db.com/exploits/15766 -
References	~~() http://www.securityfocus.com/bid/45481 - Exploit~~	() http://www.securityfocus.com/bid/45481 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/64199 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/64199 -

Information

Published : 2010-12-22 03:00

Updated : 2024-11-21 01:20

NVD link : CVE-2010-4275

Mitre link : CVE-2010-4275

CVE.ORG link : CVE-2010-4275

JSON object : View

Products Affected

dmasoftlab

radius_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-4275", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-12-22T03:00:03.140", "references": [{"url": "http://secunia.com/advisories/42364", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/15766", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/45481", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64199", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/42364", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/15766", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/45481", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64199", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) name or (2) descr parameter in an (a) update_usergroup or a (b) store_nas action to admin.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Radius Manager v3.8.0 permite a administradores autenticados remotamente inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro (1) nombre o (2) descr en (a) una acci\u00f3n update_usergroup o(b) store_nas en admin.php."}], "lastModified": "2024-11-21T01:20:35.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dmasoftlab:radius_manager:3.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDCA523E-B814-49CF-94B9-717BF1CAF4F0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}