| Vulnerability Name: | CVE-2010-1905 (CCN-58366) | ||||||||
| Assigned: | 2010-04-16 | ||||||||
| Published: | 2010-04-16 | ||||||||
| Updated: | 2018-10-10 | ||||||||
| Summary: | Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to sdccommon/verify/asp/n6plugindestructor.asp. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.9 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:TF/RC:C)
3.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:TF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-79 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2010-1905 Source: CCN Type: Expert Exchange Web site Expert Exchange Source: CCN Type: SA39740 Consona CRM Suite Password Reset and Cross-Site Scripting Vulnerabilities Source: SECUNIA Type: Vendor Advisory 39740 Source: MISC Type: UNKNOWN http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html Source: CCN Type: Consona CRM Inc. Security Bulletin For Consona Live Assistance Consona Dynamic Agent Consona Subscriber Assistance Source: CONFIRM Type: Patch, Vendor Advisory http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf Source: CCN Type: US-CERT VU#602801 Consona (formerly SupportSoft) Intelligent Assistance Suite (IAS) cross-site scripting, ActiveX, and Repair Service vulnerabilities Source: CERT-VN Type: Patch, US Government Resource VU#602801 Source: CCN Type: OSVDB ID: 64393 Consona CRM Suite ASP Page URI XSS Source: BUGTRAQ Type: UNKNOWN 20100507 [Wintercore Research] Consona Products - Multiple vulnerabilities Source: BID Type: Exploit 39999 Source: CCN Type: BID-39999 Multiple Consona Products 'n6plugindestructor.asp' Cross Site Scripting Vulnerability Source: CCN Type: Congreso de Seguridad ~ Rooted CONÂ’2010 RELEASING A 0DAY AT ROOTEDCON The Case of Consona/SupportSoft Source: MISC Type: Exploit http://www.wintercore.com/downloads/rootedcon_0day.pdf Source: XF Type: UNKNOWN crmsuite-server-xss(58366) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||