Vulners
Lucene search
Landesk Management Suite 9.5 Cross Site Scripting Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Landesk Management Suite 'serverlist_grouptree.aspx' Cross-Site Scripting Vulnerability | 5 Feb 201500:00 | – | cnvd |
 | LANDesk Management Suite AMTVersion Cross-Site Scripting (CVE-2014-5360) | 21 Jun 201500:00 | – | checkpoint_advisories |
 | CVE-2014-5360 | 3 Feb 201516:00 | – | cve |
 | CVE-2014-5360 | 3 Feb 201516:00 | – | cvelist |
 | EUVD-2014-5248 | 7 Oct 202500:30 | – | euvd |
 | CVE-2014-5360 | 3 Feb 201516:59 | – | nvd |
 | Landesk Management Suite 9.5 Cross Site Scripting | 2 Feb 201500:00 | – | packetstorm |
 | Cross site scripting | 3 Feb 201516:59 | – | prion |
 | CVE-2014-5360 Landesk Management Suite XSS (Cross-Site Scripting) Security Vulnerability | 23 Feb 201500:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 23 Feb 201500:00 | – | securityvulns |
10
Exploit Title: Landesk Management Suite Cross-Site scripting vulnerability
Product: Landesk Management Suite
Vulnerable Versions: 9.5 (possible previous versions), 9.6
Tested Version: 9.5
Advisory Publication: Feb 02, 2015
Latest Update: Feb 02, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-5360
Credit: Alex Haynes
Advisory Details:
(1) Vendor & Product Description
--------------------------------
Vendor:LANDESK
Product & Version:Landesk Management Suite v9.5
Vendor URL & Download:http://www.landesk.com/products/management-suite/
Product Description:"Manage all your users’ multi-platform desktops and mobile devices. Integrate several IT disciplinesinto a single management experience that speeds software distribution, ensures software license compliance, simplifies OS provisioning, saves power costs, provides secure remote control, and manages Mac OS X."
(2) Vulnerability Details:
--------------------------
The admin interface of Landesk Management Suite can be exploited by XSS attacks.
Proof of concept:
URL: https://<LANDESK>/remote/serverlist_grouptree.aspx?AMTVersion=+alert(5)
Parameter name: AMTVersionParameter Type: GETAttack Pattern: +alert(5)
(3) Advisory Timeline:
----------------------
15/09/2014 - First Contact
19/12/2014 - Vulnerability fixed
02/02/2015 - Advisory released
(4)Solution:
--------------
Upgrade to version 9.6 SP1 which includes a fix for this vulnerability
(5) Credits:
--------------
Discovered by Alex Haynes
References:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5360
# 0day.today [2018-03-01] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2015 00:00Current
6.1Medium risk
Vulners AI Score6.1
EPSS0.00318