CVE-2014-3365

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Prime Security Manager (PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the (1) Dashboard or (2) Configure Realm page, aka Bug ID CSCuo94808.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=37418	Vendor Advisory
http://www.securitytracker.com/id/1031716
https://exchange.xforce.ibmcloud.com/vulnerabilities/100756
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=37418	Vendor Advisory
http://www.securitytracker.com/id/1031716
https://exchange.xforce.ibmcloud.com/vulnerabilities/100756

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:prime_security_manager:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:07

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365 - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=37418 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=37418 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1031716 -~~	() http://www.securitytracker.com/id/1031716 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/100756 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/100756 -

Information

Published : 2015-02-12 01:59

Updated : 2024-11-21 02:07

NVD link : CVE-2014-3365

Mitre link : CVE-2014-3365

CVE.ORG link : CVE-2014-3365

JSON object : View

Products Affected

cisco

prime_security_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-3365", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-02-12T01:59:19.030", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=37418", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1031716", "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100756", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3365", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=37418", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031716", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100756", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Cisco Prime Security Manager (PRSM) 9.2(.1-2) and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the (1) Dashboard or (2) Configure Realm page, aka Bug ID CSCuo94808."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en Cisco Prime Security Manager (PRSM) 9.2(.1-2) y anteriores permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de entradas manipuladas en la p\u00e1gina (1) Dashboard o (2) Configure Realm, tambi\u00e9n conocido como Bug ID CSCuo94808."}], "lastModified": "2024-11-21T02:07:56.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "457CCC35-449B-4002-89FB-3D22BD4F34A8", "versionEndIncluding": "9.2.1-2"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}