CVE-2012-4970

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-4970
Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1_J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2012-12/0146.html
http://knowledgebase-iframe.polycom.com/kb/knowledgebase/End%20User/Tech%20Alerts/Video/15990_fHDX%20XSS%20Vulnerability%20-%20Security%20Bulletin%20101521.pdf
http://www.securitytracker.com/id?1027926
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:polycom:hdx_system_software:*:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.0.5_j:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.5.0.7_g:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.6.1.3:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:2.7.0_j:*:*:*:*:*:*:*
OR cpe:2.3:h:polycom:hdx_4002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_4500:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_6000:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_7001:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_7002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8004:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8006:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9004:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9006:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:polycom:hdx_system_software:*:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:polycom:hdx_system_software:3.0.3.1:*:*:*:*:*:*:*
OR cpe:2.3:h:polycom:hdx_4002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_4500:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_6000:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_7001:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_7002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8004:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_8006:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9002:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9004:-:*:*:*:*:*:*:*
cpe:2.3:h:polycom:hdx_9006:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2013-01-01 12:35

Updated : 2024-02-04 18:16

NVD link : CVE-2012-4970

Mitre link : CVE-2012-4970

CVE.ORG link : CVE-2012-4970

JSON object : View

Products Affected

polycom

  • hdx_7001
  • hdx_9004
  • hdx_4002
  • hdx_8002
  • hdx_9002
  • hdx_9006
  • hdx_7002
  • hdx_8004
  • hdx_4500
  • hdx_6000
  • hdx_8006
  • hdx_system_software
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')