CVE-2007-5582 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks Common Services 3.0.x and 3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Ciscoworks Server

Configuration 1 [-]

cpe:2.3:a:cisco:ciscoworks_server:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://secunia.com/advisories/27902
http://securityreason.com/securityalert/3449
http://securitytracker.com/id?1019043
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289
http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml
http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/
http://www.securityfocus.com/archive/1/484609/100/0/threaded
http://www.securityfocus.com/bid/26708
http://www.vupen.com/english/advisories/2007/4102
https://exchange.xforce.ibmcloud.com/vulnerabilities/38862

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2007-12-15T01:00:00

Updated: 2024-08-07T15:39:12.447Z

Reserved: 2007-10-19T00:00:00

Link: CVE-2007-5582

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-12-15T01:46:00.000

Modified: 2024-11-21T00:38:14.973

Link: CVE-2007-5582

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-12-05T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks Common Services 3.0.x and 3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "1019043", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1019043"}, {"name": "ADV-2007-4102", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/4102"}, {"tags": ["x_refsource_MISC"], "url": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/"}, {"name": "20071205 Advisory: Cross Site Scripting in CiscoWorks", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/484609/100/0/threaded"}, {"name": "3449", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3449"}, {"name": "ciscoworks-cs-loginpage-xss(38862)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38862"}, {"name": "26708", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26708"}, {"name": "20071205 CiscoWorks Server XSS Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289"}, {"name": "27902", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27902"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2007-5582", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks Common Services 3.0.x and 3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1019043", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1019043"}, {"name": "ADV-2007-4102", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/4102"}, {"name": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/", "refsource": "MISC", "url": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/"}, {"name": "20071205 Advisory: Cross Site Scripting in CiscoWorks", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/484609/100/0/threaded"}, {"name": "3449", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3449"}, {"name": "ciscoworks-cs-loginpage-xss(38862)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38862"}, {"name": "26708", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26708"}, {"name": "20071205 CiscoWorks Server XSS Vulnerability", "refsource": "CISCO", "url": "http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml"}, {"name": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289", "refsource": "CONFIRM", "url": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289"}, {"name": "27902", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27902"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:39:12.447Z"}, "title": "CVE Program Container", "references": [{"name": "1019043", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1019043"}, {"name": "ADV-2007-4102", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/4102"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/"}, {"name": "20071205 Advisory: Cross Site Scripting in CiscoWorks", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/484609/100/0/threaded"}, {"name": "3449", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3449"}, {"name": "ciscoworks-cs-loginpage-xss(38862)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38862"}, {"name": "26708", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26708"}, {"name": "20071205 CiscoWorks Server XSS Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289"}, {"name": "27902", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27902"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2007-5582", "datePublished": "2007-12-15T01:00:00", "dateReserved": "2007-10-19T00:00:00", "dateUpdated": "2024-08-07T15:39:12.447Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:ciscoworks_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB019E66-471E-44BA-BE69-55A2DC867FF0", "versionEndIncluding": "2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks Common Services 3.0.x and 3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la p\u00e1gina de inicio de sesi\u00f3n de Cisco CiscoWorks Server (CS), posiblemente 2.6 y anteriores, al utilizar CiscoWorks Common Services 3.0.x y 3.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante vectores no especificados."}], "id": "CVE-2007-5582", "lastModified": "2024-11-21T00:38:14.973", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-12-15T01:46:00.000", "references": [{"source": "ykramarz@cisco.com", "url": "http://secunia.com/advisories/27902"}, {"source": "ykramarz@cisco.com", "url": "http://securityreason.com/securityalert/3449"}, {"source": "ykramarz@cisco.com", "url": "http://securitytracker.com/id?1019043"}, {"source": "ykramarz@cisco.com", "url": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289"}, {"source": "ykramarz@cisco.com", "tags": ["Patch"], "url": "http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml"}, {"source": "ykramarz@cisco.com", "url": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/"}, {"source": "ykramarz@cisco.com", "url": "http://www.securityfocus.com/archive/1/484609/100/0/threaded"}, {"source": "ykramarz@cisco.com", "url": "http://www.securityfocus.com/bid/26708"}, {"source": "ykramarz@cisco.com", "url": "http://www.vupen.com/english/advisories/2007/4102"}, {"source": "ykramarz@cisco.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38862"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/27902"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3449"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1019043"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk69289"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/484609/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26708"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/4102"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38862"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}