CVE-2011-2694

Опубликовано: 29 июл. 2011

Источник: nvd

CVSS2: 2.6

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

Ссылки

http://jvn.jp/en/jp/JVN63041502/index.html
Third Party Advisory
http://osvdb.org/74072
Broken Link
http://samba.org/samba/history/samba-3.5.10.html
Vendor Advisory
http://secunia.com/advisories/45393
Not Applicable
Vendor Advisory
http://secunia.com/advisories/45488
Not Applicable
Third Party Advisory
http://secunia.com/advisories/45496
Not Applicable
Third Party Advisory
http://securitytracker.com/id?1025852
Broken Link
Third Party Advisory
VDB Entry
http://ubuntu.com/usn/usn-1182-1
Third Party Advisory
http://www.debian.org/security/2011/dsa-2290
Third Party Advisory
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543
Broken Link
Third Party Advisory
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543
Broken Link
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:121
Broken Link
http://www.samba.org/samba/security/CVE-2011-2694
Vendor Advisory
http://www.securityfocus.com/bid/48901
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=722537
Issue Tracking
Patch
https://bugzilla.samba.org/show_bug.cgi?id=8289
Issue Tracking
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/68844
Third Party Advisory
VDB Entry
http://jvn.jp/en/jp/JVN63041502/index.html
Third Party Advisory
http://osvdb.org/74072
Broken Link
http://samba.org/samba/history/samba-3.5.10.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.3.16 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.4.0 (включая) до 3.4.14 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 3.5.0 (включая) до 3.5.10 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03385

Низкий

2.6 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2011-2694

ubuntu

около 14 лет назад

CVE-2011-2694

redhat

около 14 лет назад

CVE-2011-2694

debian

около 14 лет назад

Cross-site scripting (XSS) vulnerability in the chg_passwd function in ...

GHSA-9xqr-g3w9-82pj

github

больше 3 лет назад

ELSA-2011-1220

oracle-oval

почти 14 лет назад

ELSA-2011-1220: samba3x security update (MODERATE)

EPSS

Процентиль: 87%

0.03385

Низкий

2.6 Low

CVSS2

Дефекты

CWE-79