CVE-2015-2223 ESM Console XSS vulnerability
Attack Vector NETWORK
Scope UNCHANGED
Attack Complexity HIGH
Confidentiality Impact LOW
Privileges Required NONE
Integrity Impact LOW
User Interaction REQUIRED
Availability Impact NONE
Description
A cross-site scripting vulnerability exists in the web-based console management. This vulnerability has been assigned CVE-2015-2223.
This issue affects the management interface of Traps, where an authenticated administrator may be tricked into injecting malicious JavaScript into the web UI interface.
This issue affects Traps ESM Console version 3.2.1 and earlier
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Traps ESM Console 3.2 | < 3.2.1.3559 | >= 3.2.1.3559 |
| Traps ESM Console 3.1 | < 3.1.5.3691 | >= 3.1.5.3691 |
Severity:MEDIUM
CVSSv3.1 Base Score:4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness Type
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Solution
Traps ESM Console 3.1.5.3691 and higher; Traps ESM Console 3.2.1.3559 and higher
Acknowledgments
Michael Hendrickx