CVE-2013-4414

Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606
http://rhn.redhat.com/errata/RHSA-2013-1851.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1852.html
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606
http://rhn.redhat.com/errata/RHSA-2013-1851.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1852.html

Configurations

Configuration 1 (hide)

cpe:2.3:o:redhat:enterprise_mrg:2.4:*:*:*:*:*:*:*

History

21 Nov 2024, 01:55

Type	Values Removed	Values Added
References	~~() http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606 -~~	() http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606 -
References	~~() http://rhn.redhat.com/errata/RHSA-2013-1851.html - Vendor Advisory~~	() http://rhn.redhat.com/errata/RHSA-2013-1851.html - Vendor Advisory
References	~~() http://rhn.redhat.com/errata/RHSA-2013-1852.html -~~	() http://rhn.redhat.com/errata/RHSA-2013-1852.html -

Information

Published : 2013-12-23 22:55

Updated : 2024-11-21 01:55

NVD link : CVE-2013-4414

Mitre link : CVE-2013-4414

CVE.ORG link : CVE-2013-4414

JSON object : View

Products Affected

redhat

enterprise_mrg

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2013-4414", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-12-23T22:55:02.817", "references": [{"url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606", "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1851.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1852.html", "source": "secalert@redhat.com"}, {"url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=998606", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1851.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1852.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the \"Max allowance\" field in the \"Set limit\" form."}, {"lang": "es", "value": "Vulnerabilidad cross-site scripting (XSS) en la interfaz web de cumin en Red Hat Enterprise MRG Grid 2.4 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a trav\u00e9s del campo \"Max allowance\" en el formulario \"Set limit\"."}], "lastModified": "2024-11-21T01:55:31.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBE39763-E666-4001-BDD3-0B11D4531366"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}