CVE-2011-2477

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escape_html_tags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence, a different vulnerability than CVE-2011-2179.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://dev.icinga.org/issues/1605	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68056

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:icinga:icinga::::::::
	cpe:2.3:a:icinga:icinga:0.8.0:::::::*
	cpe:2.3:a:icinga:icinga:0.8.1:::::::*
	cpe:2.3:a:icinga:icinga:0.8.2:::::::*
	cpe:2.3:a:icinga:icinga:0.8.3:::::::*
	cpe:2.3:a:icinga:icinga:0.8.4:::::::*
	cpe:2.3:a:icinga:icinga:1.0:::::::*
	cpe:2.3:a:icinga:icinga:1.0:rc1::::::
	cpe:2.3:a:icinga:icinga:1.0.1:::::::*
	cpe:2.3:a:icinga:icinga:1.0.2:::::::*
	cpe:2.3:a:icinga:icinga:1.0.3:::::::*
	cpe:2.3:a:icinga:icinga:1.2.0:::::::*
	cpe:2.3:a:icinga:icinga:1.2.1:::::::*
	cpe:2.3:a:icinga:icinga:1.3.0:::::::*
	cpe:2.3:a:icinga:icinga:1.3.1:::::::*

History

No history.

Information

Published : 2011-06-14 17:55

Updated : 2024-02-04 17:54

NVD link : CVE-2011-2477

Mitre link : CVE-2011-2477

CVE.ORG link : CVE-2011-2477

JSON object : View

Products Affected

icinga

icinga

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2011-2477", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-06-14T17:55:06.517", "references": [{"url": "https://dev.icinga.org/issues/1605", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68056", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escape_html_tags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence, a different vulnerability than CVE-2011-2179."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en config.c en config.cgi en Icinga antes de v1.4.1, cuando escape_html_tags est\u00e1 desactivado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de una expresi\u00f3n JavaScript, como lo demuestra el atributo onload de un elemento BODY localizado despu\u00e9s de un check-host-alive! secuencia, una vulnerabilidad diferente de CVE-2011-2179."}], "lastModified": "2017-08-29T01:29:25.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10436D2F-3CCB-4ED6-9327-3CD6BA5E43D5", "versionEndIncluding": "1.4.0"}, {"criteria": "cpe:2.3:a:icinga:icinga:0.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D65D942-0560-42B0-BAF8-D6B8C4237558"}, {"criteria": "cpe:2.3:a:icinga:icinga:0.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CF3E50F-0DF1-44C1-9E7D-E3AE9BBAC5C9"}, {"criteria": "cpe:2.3:a:icinga:icinga:0.8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F87DFD18-B038-4E18-889A-FCADDC7E9C23"}, {"criteria": "cpe:2.3:a:icinga:icinga:0.8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9B482D1-BB5D-41CC-A330-214F1EC9BD43"}, {"criteria": "cpe:2.3:a:icinga:icinga:0.8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB99BAF-6CF9-4F61-A86B-91F4DAE20F58"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B65BD554-2D66-4237-8829-EC5CFD374E4A"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51CBC3F4-EB90-462D-B840-71DB9E8E3667"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "719B37F6-4D3A-4922-B58D-536A775D42D8"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7890303A-21C3-47B8-86AF-1B07A01C9AE6"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CED3BF83-92C3-4324-BC6E-722309A8787B"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5F7F451-E7AA-4C84-874D-7C7E5C162DEA"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5250AED-B86C-4415-A274-7DD9659F40D7"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6E333C3-C264-41C9-B358-97A3F62C649D"}, {"criteria": "cpe:2.3:a:icinga:icinga:1.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEAD9B4E-66B1-4E82-8A6F-B46A4F0A61D9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}