DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:30187", "bulletinFamily": "software", "title": "[scip_Advisory 10847] MobileIron 4.5.4 Device Registration regpin Cross Site Scripting", "description": "\r\n\r\nMobileIron 4.5.4 Device Registration regpin Cross Site Scripting\r\n\r\nscip AG Vulnerability ID 10847 (10/28/2013)\r\nhttp://www.scip.ch/en/?vuldb.10847\r\n\r\nI. INTRODUCTION\r\n\r\nMobileIron is a commercial solution to provide secure access to mobile users in corporate environments.\r\n\r\nMore information is available on the official web site at the following URL:\r\n\r\nhttp://www.mobileiron.com/\r\n\r\nII. DESCRIPTION\r\n\r\nPascal Schaufelberger at scip AG found a cross site scripting vulnerability in the older release 4.5.4.\r\n\r\nAn attacker is able to inject arbitrary script code without former authentication.\r\n\r\nIII. SCORING\r\n\r\nCVSSv2 Base Score: 7.5 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)\r\nCVSSv2 Temp Score: 5.9 (CVSS2#E:POC/RL:OF/RC:C)\r\n\r\nIV. EXPLOITATION\r\n\r\nThe attack requires access to the device registration form. The attack attempt can be initiated with the following url:\r\n\r\nhttps://www.example.com/mifs/c/i/reg/reg.html?regpin=12345"><script>alert('scip')</script>\r\n\r\nV. IMPACT\r\n\r\nThis is a traditional reflected cross site scripting vulnerability, which allows the injection of arbitrary script code. An attacker might be able to alter the behavior of the web site and might therefore attack visitors.\r\n\r\nVI. DETECTION\r\n\r\nCross site scripting pattern in the regpin field should be detected and eliminated. Most security solutions provide this function out of the box.\r\n\r\nVII. SOLUTION\r\n\r\nThis issue got fixed in release 5.1.0 without further notification. Current release is 5.8, which has been available since October 2013.\r\n\r\nVIII. VENDOR RESPONSE\r\n\r\nThe issue has been reported to the vendor via email. The communication was very efficient and friendly.\r\n\r\nAfter exchange of technical details the vendor informed that this issue was known already and has been patched without further notice.\r\n\r\nIX. SOURCES\r\n\r\nscip AG - Security is our Business\r\nhttp://www.scip.ch\r\n\r\nscip AG - Vulnerability Database\r\nhttp://www.scip.ch/en/?vuldb.10847\r\n\r\nX. DISCLOSURE TIMELINE\r\n\r\n2013/09/28 Identification of the vulnerability\r\n2013/10/14 First contact to MobileIron via Twitter\r\n2013/10/15 Got mail address of MobileIron security contact\r\n2013/10/16 Initial confirmation of our submission by MobileIron\r\n2013/10/18 Detailed description of further actions by MobileIron\r\n2013/10/18 Confirmation of next steps by scip AG\r\n2013/10/28 Public disclosure of the advisory\r\n\r\nXI. CREDITS\r\n\r\nThe vulnerability has been discovered by Pascal Schaufelberger.\r\n\r\nPascal Schaufelberger, scip AG, Zuerich, Switzerland\r\npasc-at-scip.ch\r\nhttp://www.scip.ch\r\n\r\nThe disclosure process has been handled by Marc Ruef.\r\n\r\nMarc Ruef, scip AG, Zuerich, Switzerland\r\nmaru-at-scip.ch\r\nhttp://www.scip.ch\r\n\r\nA1. LEGAL NOTICES\r\n\r\nCopyright (c) 2002-2013 scip AG, Switzerland.\r\n\r\nPermission is granted for the re-distribution of this alert. It may not\r\nbe edited in any way without permission of scip AG.\r\n\r\nThe information in the advisory is believed to be accurate at the time\r\nof publishing based on currently available information. There are no\r\nwarranties with regard to this information. Neither the author nor the\r\npublisher accepts any liability for any direct, indirect or\r\nconsequential loss or damage from use of or reliance on this advisory.\r\n", "published": "2014-01-08T00:00:00", "modified": "2014-01-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30187", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:50", "edition": 1, "viewCount": 35, "enchantments": {"score": {"value": 0.2, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13506"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13506"]}]}, "exploitation": null, "vulnersScore": 0.2}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645594476, "score": 1659803227}, "_internal": {"score_hash": "d9accd4b8e3d14402ba4efbef1177943"}}

{}