CVE-2011-2585

Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges, aka Bug ID CSCto69857.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns	Vendor Advisory
http://www.securityfocus.com/bid/50285
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns	Vendor Advisory
http://www.securityfocus.com/bid/50285

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:show_and_share::::::::
	cpe:2.3:a:cisco:show_and_share:5\(2\):::::::*
	cpe:2.3:a:cisco:show_and_share:5.2\(1\):::::::*

History

21 Nov 2024, 01:28

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/50285 -~~	() http://www.securityfocus.com/bid/50285 -

Information

Published : 2011-10-20 00:55

Updated : 2024-11-21 01:28

NVD link : CVE-2011-2585

Mitre link : CVE-2011-2585

CVE.ORG link : CVE-2011-2585

JSON object : View

Products Affected

cisco

show_and_share

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2011-2585", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-10-20T00:55:00.707", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/50285", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-sns", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/50285", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges, aka Bug ID CSCto69857."}, {"lang": "es", "value": "Cisco Show y Share v5(2), v5.2(1), y v5.2(2) anterior a v5.2(2.1) permite a usuarios autenticados de forma remota subir y ejecutar c\u00f3digo de su elecci\u00f3n aprovechando la subida de privilegios de v\u00eddeo, tambi\u00e9n conocido como Bug ID CSCto69857."}], "lastModified": "2024-11-21T01:28:31.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:show_and_share:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D806BA1-0346-4DA0-A02F-4FAEA6A78498", "versionEndIncluding": "5.2\\(2\\)"}, {"criteria": "cpe:2.3:a:cisco:show_and_share:5\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE30C9B4-8EAF-4046-B715-36C6450562E0"}, {"criteria": "cpe:2.3:a:cisco:show_and_share:5.2\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9789694-853B-433D-8A9D-D92B655BC9E7"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}