Details of VAR-201301-0152

ID

VAR-201301-0152

CVE

CVE-2012-6397

TITLE

Cisco WebEx Social Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2013-001204

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cisco WebEx Social (formerly Cisco Quad) allows remote attackers to inject arbitrary web script or HTML via a crafted RSS service link, aka Bug ID CSCub61977. Cisco WebEx Social ( Former name : Quad) Contains a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. This issue is being tracked by the Cisco Bug ID CSCub61977. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Cisco WebEx Social Information Disclosure and Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA51996 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51996/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51996 RELEASE DATE: 2013-01-28 DISCUSS ADVISORY: http://secunia.com/advisories/51996/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51996/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51996 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Two vulnerabilities have been reported in Cisco WebEx Social, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks. 1) An error within the search functionality can be exploited to access certain local files via specially crafted parameters. 2) Certain input passed via Rich Site Summary (RSS) service links is not properly sanitised before being returned to the user. SOLUTION: No official solution is currently available. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6397 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1107 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2012-6397 // JVNDB: JVNDB-2013-001204 // BID: 57534 // VULHUB: VHN-59678 // PACKETSTORM: 119844

AFFECTED PRODUCTS

vendor:	cisco	model:	webex social	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	quad	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	quad	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex social	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	webex social	scope:	eq	version:	0	Trust: 0.3

sources: BID: 57534 // JVNDB: JVNDB-2013-001204 // CNNVD: CNNVD-201301-369 // NVD: CVE-2012-6397

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-6397
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-6397
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201301-369
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-59678
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-6397
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-59678
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-59678 // JVNDB: JVNDB-2013-001204 // CNNVD: CNNVD-201301-369 // NVD: CVE-2012-6397

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-59678 // JVNDB: JVNDB-2013-001204 // NVD: CVE-2012-6397

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201301-369

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 119844 // CNNVD: CNNVD-201301-369

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-001204

PATCH

title:

Cisco WebEx Social Cross-site Scripting Vulnerability in RSS Service

url:

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6397

Trust: 0.8

sources: JVNDB: JVNDB-2013-001204

EXTERNAL IDS

db:	NVD	id:	CVE-2012-6397	Trust: 2.9
db:	JVNDB	id:	JVNDB-2013-001204	Trust: 0.8
db:	CNNVD	id:	CNNVD-201301-369	Trust: 0.7
db:	CISCO	id:	20130110 CISCO WEBEX SOCIAL CROSS-SITE SCRIPTING VULNERABILITY IN RSS SERVICE	Trust: 0.6
db:	BID	id:	57534	Trust: 0.4
db:	SECUNIA	id:	51996	Trust: 0.2
db:	VULHUB	id:	VHN-59678	Trust: 0.1
db:	PACKETSTORM	id:	119844	Trust: 0.1

sources: VULHUB: VHN-59678 // BID: 57534 // JVNDB: JVNDB-2013-001204 // PACKETSTORM: 119844 // CNNVD: CNNVD-201301-369 // NVD: CVE-2012-6397

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2012-6397	Trust: 2.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6397	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-6397	Trust: 0.8
url:	http://www.cisco.com/web/products/quad/index.html	Trust: 0.3
url:	http://secunia.com/advisories/51996/#comments	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=51996	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-1107	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/blog/325/	Trust: 0.1
url:	http://secunia.com/advisories/51996/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-59678 // BID: 57534 // JVNDB: JVNDB-2013-001204 // PACKETSTORM: 119844 // CNNVD: CNNVD-201301-369 // NVD: CVE-2012-6397

CREDITS

Cisco

Trust: 0.3

sources: BID: 57534

SOURCES

db:	VULHUB	id:	VHN-59678
db:	BID	id:	57534
db:	JVNDB	id:	JVNDB-2013-001204
db:	PACKETSTORM	id:	119844
db:	CNNVD	id:	CNNVD-201301-369
db:	NVD	id:	CVE-2012-6397

LAST UPDATE DATE

2024-11-23T22:08:37.767000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-59678	date:	2013-01-29T00:00:00
db:	BID	id:	57534	date:	2013-01-10T00:00:00
db:	JVNDB	id:	JVNDB-2013-001204	date:	2013-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201301-369	date:	2013-01-18T00:00:00
db:	NVD	id:	CVE-2012-6397	date:	2024-11-21T01:46:05.290

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-59678	date:	2013-01-17T00:00:00
db:	BID	id:	57534	date:	2013-01-10T00:00:00
db:	JVNDB	id:	JVNDB-2013-001204	date:	2013-01-22T00:00:00
db:	PACKETSTORM	id:	119844	date:	2013-01-28T06:24:01
db:	CNNVD	id:	CNNVD-201301-369	date:	2013-01-18T00:00:00
db:	NVD	id:	CVE-2012-6397	date:	2013-01-17T15:55:01.610