Sign-up

ID

VAR-201505-0132


CVE

CVE-2015-0714


TITLE

Cisco Finesse Server cross-site scripting vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2015-002526 // CNNVD: CNNVD-201505-013

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595. Cisco Finesse The server contains a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCut53595. The solution provides communities and customer service organizations with an interactive assistance experience (like traditional call center functionality). The following releases are affected: Cisco Finesse Server Release 10.0(1), Release 10.5(1), Release 10.6(1), Release 11.0(1)

Trust: 1.98

sources: NVD: CVE-2015-0714 // JVNDB: JVNDB-2015-002526 // BID: 74435 // VULHUB: VHN-78660

AFFECTED PRODUCTS

vendor:ciscomodel:finessescope:eqversion:10.0\(1\)_base

Trust: 1.6

vendor:ciscomodel:finessescope:eqversion:10.6\(1\)_base

Trust: 1.6

vendor:ciscomodel:finessescope:eqversion:10.5\(1\)_base

Trust: 1.6

vendor:ciscomodel:finessescope:eqversion:11.0\(1\)_base

Trust: 1.6

vendor:ciscomodel:finessescope:eqversion:11.0(1)

Trust: 1.1

vendor:ciscomodel:finessescope:eqversion:10.6(1)

Trust: 1.1

vendor:ciscomodel:finessescope:eqversion:10.5(1)

Trust: 1.1

vendor:ciscomodel:finessescope:eqversion:10.0(1)

Trust: 1.1

sources: BID: 74435 // JVNDB: JVNDB-2015-002526 // CNNVD: CNNVD-201505-013 // NVD: CVE-2015-0714

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0714
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-0714
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201505-013
value: MEDIUM

Trust: 0.6

VULHUB: VHN-78660
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-0714
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-78660
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78660 // JVNDB: JVNDB-2015-002526 // CNNVD: CNNVD-201505-013 // NVD: CVE-2015-0714

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-78660 // JVNDB: JVNDB-2015-002526 // NVD: CVE-2015-0714

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-013

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201505-013

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002526

PATCH
title:38607url:http://tools.cisco.com/security/center/viewAlert.x?alertId=38607
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-002526

EXTERNAL IDS
db:NVDid:CVE-2015-0714
Trust: 2.8
db:SECTRACKid:1032222
Trust: 1.1
db:JVNDBid:JVNDB-2015-002526
Trust: 0.8
db:CNNVDid:CNNVD-201505-013
Trust: 0.6
db:BIDid:74435
Trust: 0.4
db:VULHUBid:VHN-78660
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78660 // 
            
            
            
            BID: 74435 // 
            
            
            
            JVNDB: JVNDB-2015-002526 // 
            
            
            
            CNNVD: CNNVD-201505-013 // 
            
            
            
            NVD: CVE-2015-0714

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=38607
Trust: 1.7
url:http://www.securitytracker.com/id/1032222
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0714
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0714
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:http://tools.cisco.com/security/center/viewalert.x?alertid=38607 
Trust: 0.3
sources:
            
            
            VULHUB: VHN-78660 // 
            
            
            
            BID: 74435 // 
            
            
            
            JVNDB: JVNDB-2015-002526 // 
            
            
            
            CNNVD: CNNVD-201505-013 // 
            
            
            
            NVD: CVE-2015-0714

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 74435

SOURCES
db:VULHUBid:VHN-78660
db:BIDid:74435
db:JVNDBid:JVNDB-2015-002526
db:CNNVDid:CNNVD-201505-013
db:NVDid:CVE-2015-0714

LAST UPDATE DATE
2024-11-23T22:01:46.084000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78660date:2015-09-10T00:00:00
db:BIDid:74435date:2015-05-01T00:00:00
db:JVNDBid:JVNDB-2015-002526date:2015-05-07T00:00:00
db:CNNVDid:CNNVD-201505-013date:2015-05-04T00:00:00
db:NVDid:CVE-2015-0714date:2024-11-21T02:23:35.310

SOURCES RELEASE DATE
db:VULHUBid:VHN-78660date:2015-05-02T00:00:00
db:BIDid:74435date:2015-05-01T00:00:00
db:JVNDBid:JVNDB-2015-002526date:2015-05-07T00:00:00
db:CNNVDid:CNNVD-201505-013date:2015-05-04T00:00:00
db:NVDid:CVE-2015-0714date:2015-05-02T14:59:00.103