CVE-2012-1990

Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll, (2) unspecified search fields, or (3) unspecified content-display fields.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/49041	Vendor Advisory
http://www.phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html
http://www.securityfocus.com/bid/53409

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:schneider-electric:kerweb::::::::
	cpe:2.3:a:schneider-electric:kerwin::::::::

History

No history.

Information

Published : 2012-05-22 16:55

Updated : 2024-02-04 18:16

NVD link : CVE-2012-1990

Mitre link : CVE-2012-1990

CVE.ORG link : CVE-2012-1990

JSON object : View

Products Affected

schneider-electric

kerwin
kerweb

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-1990", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-05-22T16:55:01.180", "references": [{"url": "http://secunia.com/advisories/49041", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/53409", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll, (2) unspecified search fields, or (3) unspecified content-display fields."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en Schneider Electric Kerweb de antes de v3.0.1 Y Kerwin antes de v6.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a traves de (1) el parametro 'evtvariablename' en una accion evts.xml a kw.dll, (2) campos de b\u00fasqueda no especificados, o (3) campos de contenido no especificados."}], "lastModified": "2013-05-15T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:kerweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C93B7DA1-8D81-4D37-86B1-BD44FBC23C66", "versionEndIncluding": "3.0"}, {"criteria": "cpe:2.3:a:schneider-electric:kerwin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "563DE126-88B6-4A7D-9B25-06CCDB67D010", "versionEndIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}