CVE-2015-8687

Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
References
Link Resource
http://seclists.org/fulldisclosure/2016/Jan/0 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:alcatel-lucent:motive_home_device_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-03-23 20:59

Updated : 2024-02-04 19:11


NVD link : CVE-2015-8687

Mitre link : CVE-2015-8687

CVE.ORG link : CVE-2015-8687


JSON object : View

Products Affected

alcatel-lucent

  • motive_home_device_manager
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')