Sign-up

ID

VAR-201105-0048


CVE

CVE-2011-0961


TITLE

Cisco CiscoWorks Common Services Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2011-003129

DESCRIPTION

Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704. The problem is Bug ID CSCto12704 It is a problem.Any third party, through the device parameters, Web script And HTML May be inserted. Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and launch other attacks. This issue is being monitored by Cisco Bug ID CSCto12704. CiscoWorks Common Services 3.3 and prior are vulnerable. ---------------------------------------------------------------------- http://twitter.com/secunia http://www.facebook.com/Secunia ---------------------------------------------------------------------- TITLE: CiscoWorks Common Services "device" Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA44645 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44645/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44645 RELEASE DATE: 2011-05-20 DISCUSS ADVISORY: http://secunia.com/advisories/44645/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44645/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44645 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in CiscoWorks Common Services, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the "device" parameter to cwhp/device.center.do in the Framework Help servlet is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. SOLUTION: Update to a fixed version. PROVIDED AND/OR DISCOVERED BY: Sense of Security Labs ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=23088 Sense of Security Labs: http://www.senseofsecurity.com.au/advisories/SOS-11-006 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Sense of Security - Security Advisory - SOS-11-006 Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Platform. Microsoft Windows Affected versions. CuOM 8.0 and 8.5 (verified), possibly others. Severity Rating. Medium - Low Impact. Database access, cookie and credential theft, impersonation, loss of confidentiality, local file disclosure, information disclosure. Attack Vector. Remote with authentication Solution Status. Vendor patch (upgrade to CuOM 8.6 as advised by Cisco) CVE reference. CVE-2011-0959 (CSCtn61716) CVE-2011-0960 (CSCtn61716) CVE-2011-0961 (CSCto12704) CVE-2011-0962 (CSCto12712) CVE-2011-0966 (CSCto35577) Details. Cisco Unified Operations Manager (CuOM) is a NMS for voice developed by Cisco Systems. Operations Manager monitors and evaluates the current status of both the IP communications infrastructure and the underlying transport infrastructure in your network. Multiple vulnerabilities have been identified in Cisco Unified Operations Manager and associated products. These vulnerabilities include multiple blind SQL injections, multiple XSS. and a directory traversal vulnerability. 1. Blind SQL injection vulnerabilities that affect CuOM CVE-2011-0960 (CSCtn61716): The Variable CCMs of PRTestCreation can trigger a blind SQL injection vulnerability by supplying a single quote, followed by a time delay call: /iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20 delay'0:0:20'--&Extns=&IPs= Additionally, variable ccm of TelePresenceReportAction can trigger a blind SQL injection vulnerability by supplying a single quote: /iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'-- 2. Directory traversal vulnerability that affects CiscoWorks Homepage CVE-2011-0966 (CSCto35577): http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini cmfDBA user database info: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope rties DB connection info for all databases: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper ties Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example. DB password change log: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\log\dbpwdChange.log Solution. Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and CSCto35577 for information on patches and availability of fixes. Discovered by. Sense of Security Labs. About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the countries largest organisations. Sense of Security Pty Ltd Level 8, 66 King St Sydney NSW 2000 AUSTRALIA T: +61 (0)2 9290 4444 F: +61 (0)2 9290 4455 W: http://www.senseofsecurity.com.au E: info@senseofsecurity.com.au Twitter: @ITsecurityAU The latest version of this advisory can be found at: http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php

Trust: 2.16

sources: NVD: CVE-2011-0961 // JVNDB: JVNDB-2011-003129 // BID: 47902 // VULHUB: VHN-48906 // PACKETSTORM: 101571 // PACKETSTORM: 101518

AFFECTED PRODUCTS

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.1.1

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.6

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.5

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.4

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.3

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.2

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.1

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:2.2

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:lteversion:3.3

Trust: 1.8

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:1.0

Trust: 1.3

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.3

Trust: 0.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:2.3

Trust: 0.3

sources: BID: 47902 // JVNDB: JVNDB-2011-003129 // CNNVD: CNNVD-201105-205 // NVD: CVE-2011-0961

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0961
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-0961
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201105-205
value: MEDIUM

Trust: 0.6

VULHUB: VHN-48906
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-0961
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-48906
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-48906 // JVNDB: JVNDB-2011-003129 // CNNVD: CNNVD-201105-205 // NVD: CVE-2011-0961

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-48906 // JVNDB: JVNDB-2011-003129 // NVD: CVE-2011-0961

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 101518 // CNNVD: CNNVD-201105-205

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 101571 // CNNVD: CNNVD-201105-205

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003129

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-48906

PATCH
title:23088url:http://tools.cisco.com/security/center/viewAlert.x?alertId=23088
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-003129

EXTERNAL IDS
db:NVDid:CVE-2011-0961
Trust: 2.9
db:EXPLOIT-DBid:17304
Trust: 1.7
db:BIDid:47902
Trust: 1.4
db:JVNDBid:JVNDB-2011-003129
Trust: 0.8
db:CNNVDid:CNNVD-201105-205
Trust: 0.7
db:SECUNIAid:44645
Trust: 0.7
db:FULLDISCid:20110518 CISCO UNIFIED OPERATIONS MANAGER MULTIPLE VULNERABILITIES - SOS-11-006
Trust: 0.6
db:XFid:67523
Trust: 0.6
db:EXPLOIT-DBid:35779
Trust: 0.1
db:VULHUBid:VHN-48906
Trust: 0.1
db:PACKETSTORMid:101571
Trust: 0.1
db:PACKETSTORMid:101518
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48906 // 
            
            
            
            BID: 47902 // 
            
            
            
            JVNDB: JVNDB-2011-003129 // 
            
            
            
            PACKETSTORM: 101571 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            CNNVD: CNNVD-201105-205 // 
            
            
            
            NVD: CVE-2011-0961

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=23088
Trust: 2.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf
Trust: 2.1
url:http://www.exploit-db.com/exploits/17304
Trust: 1.7
url:http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
Trust: 1.7
url:http://www.securityfocus.com/bid/47902
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/67523
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0961
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0961
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/67523
Trust: 0.6
url:http://secunia.com/advisories/44645
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:http://twitter.com/secunia
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://www.facebook.com/secunia
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/44645/#comments
Trust: 0.1
url:http://secunia.com/advisories/44645/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=44645
Trust: 0.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\program
Trust: 0.1
url:http://www.senseofsecurity.com.au
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0961
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0960
Trust: 0.1
url:http://www.senseofsecurity.com.au/research/it-security-advisories.php
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0962
Trust: 0.1
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\boot.ini
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0966
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0959
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48906 // 
            
            
            
            BID: 47902 // 
            
            
            
            JVNDB: JVNDB-2011-003129 // 
            
            
            
            PACKETSTORM: 101571 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            CNNVD: CNNVD-201105-205 // 
            
            
            
            NVD: CVE-2011-0961

CREDITS
Sense of Security Labs
Trust: 0.3
sources:
            
            
            BID: 47902

SOURCES
db:VULHUBid:VHN-48906
db:BIDid:47902
db:JVNDBid:JVNDB-2011-003129
db:PACKETSTORMid:101571
db:PACKETSTORMid:101518
db:CNNVDid:CNNVD-201105-205
db:NVDid:CVE-2011-0961

LAST UPDATE DATE
2025-04-11T22:54:02.050000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-48906date:2017-08-17T00:00:00
db:BIDid:47902date:2015-03-19T07:35:00
db:JVNDBid:JVNDB-2011-003129date:2011-12-01T00:00:00
db:CNNVDid:CNNVD-201105-205date:2011-05-23T00:00:00
db:NVDid:CVE-2011-0961date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-48906date:2011-05-20T00:00:00
db:BIDid:47902date:2011-05-18T00:00:00
db:JVNDBid:JVNDB-2011-003129date:2011-12-01T00:00:00
db:PACKETSTORMid:101571date:2011-05-20T05:48:13
db:PACKETSTORMid:101518date:2011-05-18T14:17:13
db:CNNVDid:CNNVD-201105-205date:2011-05-20T00:00:00
db:NVDid:CVE-2011-0961date:2011-05-20T22:55:02.987