Vulnerability CVE-2010-3289 - CERT Civis.Net

Vulnerability Name:

CVE-2010-3289 (CCN-62679)

Assigned:

2010-10-19

Published:

2010-10-19

Updated:

2017-08-17

Summary:

Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-3289

Source: HP
Type: Vendor Advisory
SSRT100299

Source: CCN
Type: SA41908
HP Systems Insight Manager Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1024622
HP System Insight Manager Flaws Let Remote Authenticated Users Gain Elevated Privileges and Remote Users Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks

Source: CCN
Type: OSVDB ID: 68861
HP Systems Insight Manager Unspecified XSS (2010-3289)

Source: BID
Type: UNKNOWN
44262

Source: CCN
Type: BID-44262
HP Systems Insight Manager CVE-2010-3289 Unspecified Cross Site Scripting Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024622

Source: XF
Type: UNKNOWN
hp-sim-unspec-xss(62679)

Source: XF
Type: UNKNOWN
hp-sim-unspec-xss(62679)

Source: CCN
Type: HP Security Bulletin HPSBMA02591 SSRT100299 rev.1
HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS), Privilege Escalation

Vulnerable Configuration:

Configuration 1:

cpe:/a:hp:systems_insight_manager:*:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:2.5:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:2.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.0:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.1:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.1:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:sp2:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp2:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp3:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp4:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp5:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.1:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.2:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.2:update_1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.3:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.3:update_1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:6.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:*:*:*:*:*:*:*:* (Version <= 6.1)

Configuration CCN 1:

cpe:/a:hp:systems_insight_manager:6.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:6.1:*:*:*:*:*:*:*

Denotes that component is vulnerable