CVE-2015-7252

Опубликовано: 30 дек. 2015

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Средний

Описание

Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter.

Ссылки

http://www.securityfocus.com/bid/77421
https://www.exploit-db.com/exploits/38773/
https://www.kb.cert.org/vuls/id/391604
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/77421
https://www.exploit-db.com/exploits/38773/
https://www.kb.cert.org/vuls/id/391604
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/BLUU-9ZDJWA
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:zte:zxhn_h108n_r1a_firmware:*:*:*:*:*:*:*:*

Версия до zte.bhs.zxhnh108nr1a.h_pe (включая)

cpe:2.3:h:zte:zxhn_h108n_r1a:*:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.24048

Средний

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-v877-jx8x-6qr4