CVE-2015-0656

Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0656	Vendor Advisory
http://www.securitytracker.com/id/1031827

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:network_analysis_module_firmware:6.0\(2\):*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:network_analysis_module_2304::::::::
	cpe:2.3:h:cisco:network_analysis_module_2320::::::::

History

No history.

Information

Published : 2015-03-04 02:59

Updated : 2024-02-04 18:35

NVD link : CVE-2015-0656

Mitre link : CVE-2015-0656

CVE.ORG link : CVE-2015-0656

JSON object : View

Products Affected

cisco

network_analysis_module_firmware
network_analysis_module_2304
network_analysis_module_2320

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-0656", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-03-04T02:59:00.053", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0656", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1031827", "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269."}, {"lang": "es", "value": "Vulnerabilidad de XSS en la p\u00e1gina de inicio de sesi\u00f3n en Cisco Network Analysis Module (NAM) permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como Bug ID CSCum81269."}], "lastModified": "2015-11-02T18:29:23.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:network_analysis_module_firmware:6.0\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F080EB9F-64E9-4336-A1C8-24FCDB70700F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:network_analysis_module_2304:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8C101646-1B5B-4015-8441-7DF06D7A70DB"}, {"criteria": "cpe:2.3:h:cisco:network_analysis_module_2320:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3650F3A0-5A2D-4758-93A6-C6A8981E03F1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}