Details of VAR-201504-0286

ID

VAR-201504-0286

CVE

CVE-2015-0707

TITLE

Cisco FireSIGHT Management Center of FireSIGHT system Software cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-002475

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cisco FireSIGHT System Software 5.3.1.1 and 6.0.0 in FireSIGHT Management Center allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCus85425. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. This issue is being tracked by Cisco Bug ID CSCus85425. Cisco FireSIGHT System Software on Sourcefire 3D Sensor devices is a management center based on 3D Sensor devices of Cisco (Cisco), which supports centralized management of network security and operation functions of Cisco ASA and Cisco FirePOWER network security devices using FirePOWER Services. Lights-Out Management (LOM) is one implementation that supports system administrators to monitor and manage servers remotely

Trust: 1.98

sources: NVD: CVE-2015-0707 // JVNDB: JVNDB-2015-002475 // BID: 74294 // VULHUB: VHN-78653

AFFECTED PRODUCTS

vendor:	cisco	model:	firesight system software	scope:	eq	version:	6.0.0	Trust: 2.7
vendor:	cisco	model:	firesight system software	scope:	eq	version:	5.3.1.1	Trust: 2.7

sources: BID: 74294 // JVNDB: JVNDB-2015-002475 // CNNVD: CNNVD-201504-445 // NVD: CVE-2015-0707

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-0707
value:	LOW
Trust: 1.0
NVD:	CVE-2015-0707
value:	LOW
Trust: 0.8
CNNVD:	CNNVD-201504-445
value:	LOW
Trust: 0.6
VULHUB:	VHN-78653
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2015-0707
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-78653
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-78653 // JVNDB: JVNDB-2015-002475 // CNNVD: CNNVD-201504-445 // NVD: CVE-2015-0707

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-78653 // JVNDB: JVNDB-2015-002475 // NVD: CVE-2015-0707

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201504-445

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201504-445

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-002475

PATCH

title:

38487

url:

http://tools.cisco.com/security/center/viewAlert.x?alertId=38487

Trust: 0.8

sources: JVNDB: JVNDB-2015-002475

EXTERNAL IDS

db:	NVD	id:	CVE-2015-0707	Trust: 2.8
db:	JVNDB	id:	JVNDB-2015-002475	Trust: 0.8
db:	CNNVD	id:	CNNVD-201504-445	Trust: 0.7
db:	BID	id:	74294	Trust: 0.4
db:	VULHUB	id:	VHN-78653	Trust: 0.1

sources: VULHUB: VHN-78653 // BID: 74294 // JVNDB: JVNDB-2015-002475 // CNNVD: CNNVD-201504-445 // NVD: CVE-2015-0707

REFERENCES

url:	http://tools.cisco.com/security/center/viewalert.x?alertid=38487	Trust: 2.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0707	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0707	Trust: 0.8
url:	http://www.cisco.com	Trust: 0.3

sources: VULHUB: VHN-78653 // BID: 74294 // JVNDB: JVNDB-2015-002475 // CNNVD: CNNVD-201504-445 // NVD: CVE-2015-0707

CREDITS

Cisco

Trust: 0.3

sources: BID: 74294

SOURCES

db:	VULHUB	id:	VHN-78653
db:	BID	id:	74294
db:	JVNDB	id:	JVNDB-2015-002475
db:	CNNVD	id:	CNNVD-201504-445
db:	NVD	id:	CVE-2015-0707

LAST UPDATE DATE

2024-11-23T22:56:25.802000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-78653	date:	2015-04-23T00:00:00
db:	BID	id:	74294	date:	2015-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2015-002475	date:	2015-04-27T00:00:00
db:	CNNVD	id:	CNNVD-201504-445	date:	2015-04-23T00:00:00
db:	NVD	id:	CVE-2015-0707	date:	2024-11-21T02:23:34.537

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-78653	date:	2015-04-23T00:00:00
db:	BID	id:	74294	date:	2015-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2015-002475	date:	2015-04-27T00:00:00
db:	CNNVD	id:	CNNVD-201504-445	date:	2015-04-23T00:00:00
db:	NVD	id:	CVE-2015-0707	date:	2015-04-23T02:00:17.193