Lucene search

MitreCVE-2012-1410

HistoryFeb 29, 2012 - 11:55 a.m.

CVE-2012-1410

2012-02-2911:55:05

CWE-79

mitre

web.nvd.nist.gov

cve-2012-1410

cross-site scripting

xss

kadu

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.

Affected configurations

Nvd

Node

kadukaduMatch0.9.0

kadukaduMatch0.10.0

kadukaduMatch0.11.0

VendorProductVersionCPE
kadukadu0.9.0cpe:2.3:a:kadu:kadu:0.9.0:*:*:*:*:*:*:*
kadukadu0.10.0cpe:2.3:a:kadu:kadu:0.10.0:*:*:*:*:*:*:*
kadukadu0.11.0cpe:2.3:a:kadu:kadu:0.11.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kadu	kadu	0.9.0	cpe:2.3:a:kadu:kadu:0.9.0:::::::*
kadu	kadu	0.10.0	cpe:2.3:a:kadu:kadu:0.10.0:::::::*
kadu	kadu	0.11.0	cpe:2.3:a:kadu:kadu:0.11.0:::::::*

References

www.openwall.com/lists/oss-security/2012/02/27/26

www.openwall.com/lists/oss-security/2012/02/27/3

bugzilla.novell.com/show_bug.cgi?id=749036

bugzilla.redhat.com/show_bug.cgi?id=797777

gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6

gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0

gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84

gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.6

Confidence

High

EPSS

0.004

Percentile

73.8%

JSON

Related for CVE-2012-1410