CVE-2012-3842

Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html
http://www.securityfocus.com/bid/53281	Exploit
http://www.vulnerability-lab.com/get_content.php?id=509
http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html
http://www.securityfocus.com/bid/53281	Exploit
http://www.vulnerability-lab.com/get_content.php?id=509

Configurations

Configuration 1 (hide)

cpe:2.3:a:jbmc-software:directadmin:1.403:*:*:*:*:*:*:*

History

21 Nov 2024, 01:41

Type	Values Removed	Values Added
References	~~() http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html -~~	() http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html -
References	~~() http://www.securityfocus.com/bid/53281 - Exploit~~	() http://www.securityfocus.com/bid/53281 - Exploit
References	~~() http://www.vulnerability-lab.com/get_content.php?id=509 -~~	() http://www.vulnerability-lab.com/get_content.php?id=509 -

Information

Published : 2012-07-03 22:55

Updated : 2024-11-21 01:41

NVD link : CVE-2012-3842

Mitre link : CVE-2012-3842

CVE.ORG link : CVE-2012-3842

JSON object : View

Products Affected

jbmc-software

directadmin

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-3842", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-07-03T22:55:03.037", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/53281", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vulnerability-lab.com/get_content.php?id=509", "source": "cve@mitre.org"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/53281", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vulnerability-lab.com/get_content.php?id=509", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en CMD_DOMAIN en JBMC Software DirectAdmin v1.403, permite a usuarios con ciertos privilegios autenticados remotamente, inyectar secuencias de comandos web o HTML a trav\u00e9s de los par\u00e1metros (1) select0 o (2) select8."}], "lastModified": "2024-11-21T01:41:44.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jbmc-software:directadmin:1.403:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B4A1FB4-2316-43D3-8E43-D19A906654ED"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}