CVE-2015-0513

Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2015-01/0092.html	Broken Link
http://www.securityfocus.com/bid/72259	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1031567

Configurations

Configuration 1 (hide)

cpe:2.3:a:emc:watch4net:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:emc:vipr_srm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-01-21 15:17

Updated : 2024-02-28 12:20

NVD link : CVE-2015-0513

Mitre link : CVE-2015-0513

CVE.ORG link : CVE-2015-0513

JSON object : View

Products Affected

emc

watch4net
vipr_srm

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-0513", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-01-21T15:17:11.387", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2015-01/0092.html", "tags": ["Broken Link"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/bid/72259", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1031567", "source": "security_alert@emc.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades XSS en la interfaz de usuario de administraci\u00f3n en EMC M&R (tambi\u00e9n conocido como Watch4Net) anterior a 6.5u1 y ViPR SRM anterior a 3.6.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios aprovech\u00e1ndose de privilegios de acceso para establecer valores modificados de campos sin especificar"}], "lastModified": "2017-01-03T02:59:40.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:watch4net:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED56487F-4AA2-463F-9E14-F80639F88520", "versionEndIncluding": "6.5"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:vipr_srm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76B4F87A-7B05-439C-9CFF-1EEC3DFC20DB", "versionEndIncluding": "3.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}