Lucene search

[email protected]CVE-2013-5108

HistoryDec 05, 2013 - 6:55 p.m.

CVE-2013-5108

2013-12-0518:55:12

CWE-79

[email protected]

web.nvd.nist.gov

xss

cross-site scripting

rockmongo

security vulnerabilities

cve-2013-5108

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) db parameter on the login page or (2) username parameter in a login.index action to index.php and other unspecified parameters.

Affected configurations

NVD

Node

rockmongorockmongoRange≤1.1.5

rockmongorockmongoMatch1.0

rockmongorockmongoMatch1.0.1

rockmongorockmongoMatch1.0.2

rockmongorockmongoMatch1.0.3

rockmongorockmongoMatch1.0.4

rockmongorockmongoMatch1.0.5

rockmongorockmongoMatch1.0.6

rockmongorockmongoMatch1.0.7

rockmongorockmongoMatch1.0.8

rockmongorockmongoMatch1.0.9

rockmongorockmongoMatch1.0.10

rockmongorockmongoMatch1.0.11

rockmongorockmongoMatch1.0.12

rockmongorockmongoMatch1.1.1

rockmongorockmongoMatch1.1.2

rockmongorockmongoMatch1.1.3

rockmongorockmongoMatch1.1.4

CPENameOperatorVersion
rockmongo:rockmongorockmongole1.1.5
rockmongo:rockmongorockmongoeq1.0
rockmongo:rockmongorockmongoeq1.0.1
rockmongo:rockmongorockmongoeq1.0.2
rockmongo:rockmongorockmongoeq1.0.3
rockmongo:rockmongorockmongoeq1.0.4
rockmongo:rockmongorockmongoeq1.0.5
rockmongo:rockmongorockmongoeq1.0.6
rockmongo:rockmongorockmongoeq1.0.7
rockmongo:rockmongorockmongoeq1.0.8

CPE	Name	Operator	Version
rockmongo:rockmongo	rockmongo	le	1.1.5
rockmongo:rockmongo	rockmongo	eq	1.0
rockmongo:rockmongo	rockmongo	eq	1.0.1
rockmongo:rockmongo	rockmongo	eq	1.0.2
rockmongo:rockmongo	rockmongo	eq	1.0.3
rockmongo:rockmongo	rockmongo	eq	1.0.4
rockmongo:rockmongo	rockmongo	eq	1.0.5
rockmongo:rockmongo	rockmongo	eq	1.0.6
rockmongo:rockmongo	rockmongo	eq	1.0.7
rockmongo:rockmongo	rockmongo	eq	1.0.8

Rows per page:

1-10 of 181

References

secunia.com/advisories/55756

exchange.xforce.ibmcloud.com/vulnerabilities/89366

www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.1%

JSON

Related for CVE-2013-5108

prion1 nvd1 cvelist1 openvas1