Lucene search

[email protected]CVE-2012-1990

HistoryMay 22, 2012 - 4:55 p.m.

CVE-2012-1990

2012-05-2216:55:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-1990

cross-site scripting

xss

vulnerabilities

schneider electric

kerweb

kerwin

remote attackers

web script

html

security

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll, (2) unspecified search fields, or (3) unspecified content-display fields.

Affected configurations

NVD

Node

schneider-electrickerwebRange≤3.0

schneider-electrickerwinRange≤6.0

CPENameOperatorVersion
schneider-electric:kerwebschneider-electric kerweble3.0
schneider-electric:kerwinschneider-electric kerwinle6.0

CPE	Name	Operator	Version
schneider-electric:kerweb	schneider-electric kerweb	le	3.0
schneider-electric:kerwin	schneider-electric kerwin	le	6.0

References

secunia.com/advisories/49041

www.phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html

www.securityfocus.com/bid/53409

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.3%

JSON

Related for CVE-2012-1990

packetstorm1 prion1 cvelist1 nvd1