medium4.3Public exploit code
CVE-2011-0961
Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attacke…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CiscoWorks Common Services Framework 3.1.1 Help Servlet - Cross-Site Scripting2011-05-18 · remote · hardware · Verified
- Cisco Unified Operations Manager - Multiple Vulnerabilities2011-05-18 · remote · windows · Verified
Impact
Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Ciscoworks Common Services | through 3.3 Versions 1.0, 2.2, 3.0, 3.0.3, 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23088
- http://www.exploit-db.com/exploits/17304
- http://www.securityfocus.com/bid/47902
- http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67523
- http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
- http://tools.cisco.com/security/center/viewAlert.x?alertId=23088
- http://www.exploit-db.com/exploits/17304
- http://www.securityfocus.com/bid/47902
- http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67523