CVE-2014-3324

Опубликовано: 26 июл. 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.0(2.8) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060.

Комментарий

Per: http://tools.cisco.com/security/center/viewAlert.x?alertId=35031

"The security vulnerability applies to the following combinations of products.

Primary Products:

Cisco Cisco TelePresence Server Software 3.0 (2.24) | 3.1 (1.98) | 4.0 (1.57), (2.8)"

Ссылки

http://secunia.com/advisories/60456
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3324
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=35031
Vendor Advisory
http://www.securityfocus.com/bid/68885
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1030640
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94847
http://secunia.com/advisories/60456
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3324
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=35031
Vendor Advisory
http://www.securityfocus.com/bid/68885
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1030640
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94847

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.24\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.98\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:telepresence_server_software:4.0\(1.57\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:telepresence_server_software:4.0\(2.8\):*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00561

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-crwp-h886-vx7j

github

больше 3 лет назад