Lucene search

[email protected]CVE-2013-5005

HistoryJan 29, 2014 - 6:55 p.m.

CVE-2013-5005

2014-01-2918:55:26

CWE-79

[email protected]

web.nvd.nist.gov

security

vulnerability

xss

ajaxrequest

methodcall

tripwire enterprise

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) m_target_class_name, (2) m_target_method_name, or (3) m_request_context_params parameters.

Affected configurations

NVD

Node

tripwiretripwire_enterpriseRange≤8.2

tripwiretripwire_enterpriseMatch7.0

CPENameOperatorVersion
tripwire:tripwire_enterprisetripwire tripwire enterprisele8.2
tripwire:tripwire_enterprisetripwire tripwire enterpriseeq7.0

CPE	Name	Operator	Version
tripwire:tripwire_enterprise	tripwire tripwire enterprise	le	8.2
tripwire:tripwire_enterprise	tripwire tripwire enterprise	eq	7.0

References

www.securityfocus.com/bid/65242

www.zerodaylab.com/zdl-advisories/2013-5005.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for CVE-2013-5005

prion1 cvelist1 nvd1