CVE-2007-5211

Multiple cross-site scripting (XSS) vulnerabilities in Arbor Networks Peakflow SP 3.5.1 before patch 14, and 3.6.1 before patch 5, when scope accounts are enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving GET or POST requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/27003	Patch
http://www.securityfocus.com/bid/25910
https://exchange.xforce.ibmcloud.com/vulnerabilities/36926

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arbor_networks:peakflow_sp:3.5.1:::::::*
	cpe:2.3:a:arbor_networks:peakflow_sp:3.6.1:::::::*

History

No history.

Information

Published : 2007-10-04 23:17

Updated : 2024-02-04 17:13

NVD link : CVE-2007-5211

Mitre link : CVE-2007-5211

CVE.ORG link : CVE-2007-5211

JSON object : View

Products Affected

arbor_networks

peakflow_sp

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-5211", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-10-04T23:17:00.000", "references": [{"url": "http://secunia.com/advisories/27003", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25910", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36926", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Arbor Networks Peakflow SP 3.5.1 before patch 14, and 3.6.1 before patch 5, when scope accounts are enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving GET or POST requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Arbor Networks Peakflow SP 3.5.1 anterior al parche 14, y 3.6.1 anterior al parche 5, cuando la opci\u00f3n de tener en cuenta el \u00e1mbito est\u00e1 habilitada, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados involucrando peticiones GET o POST. NOTA: la procedencia de esta informaci\u00f3n es desconocida; los detalles se han obtenido exclusivamente de informaci\u00f3n de terceros."}], "lastModified": "2017-07-29T01:33:27.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arbor_networks:peakflow_sp:3.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "708BB623-769B-4A33-8B62-EB6DF68C9F47"}, {"criteria": "cpe:2.3:a:arbor_networks:peakflow_sp:3.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92DD9213-870B-4FB4-B31C-489B232BF8EB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}