Vulnerability Name:

CVE-2011-0462 (CCN-66839)

Assigned:2011-03-02
Published:2011-03-02
Updated:2011-04-22
Summary:Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2011-0462

Source: CCN
Type: openSUSE Web site
Build Service team releases new versions fixing security problems

Source: CONFIRM
Type: UNKNOWN
http://news.opensuse.org/2011/03/02/build-service-team-releases-new-versions-fixing-security-problems/

Source: CCN
Type: SA44306
openSUSE Build Service Multiple Vulnerabilities

Source: CCN
Type: OSVDB ID: 73145
openSUSE Build Service (OBS) webui Component Login Page XSS

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.novell.com/show_bug.cgi?id=669909

Source: XF
Type: UNKNOWN
opensuse-login-xss(66839)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:novell:opensuse_build_service:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.6:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.7.7:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.8:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.9.90:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.9.91:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:1.9.92:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.103:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.104:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.0.106:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:2.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:novell:opensuse_build_service:*:*:*:*:*:*:*:* (Version <= 2.1.5.1)

    • Configuration CCN 1:
  • cpe:/o:opensuse:opensuse:11.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    novell opensuse build service 1.0
    novell opensuse build service 1.5
    novell opensuse build service 1.6
    novell opensuse build service 1.7
    novell opensuse build service 1.7.0
    novell opensuse build service 1.7.2
    novell opensuse build service 1.7.3
    novell opensuse build service 1.7.4
    novell opensuse build service 1.7.5
    novell opensuse build service 1.7.6
    novell opensuse build service 1.7.7
    novell opensuse build service 1.8
    novell opensuse build service 1.9.90
    novell opensuse build service 1.9.91
    novell opensuse build service 1.9.92
    novell opensuse build service 2.0
    novell opensuse build service 2.0.0
    novell opensuse build service 2.0.1
    novell opensuse build service 2.0.2
    novell opensuse build service 2.0.3
    novell opensuse build service 2.0.4
    novell opensuse build service 2.0.5
    novell opensuse build service 2.0.6
    novell opensuse build service 2.0.7
    novell opensuse build service 2.0.8
    novell opensuse build service 2.0.16
    novell opensuse build service 2.0.103
    novell opensuse build service 2.0.104
    novell opensuse build service 2.0.106
    novell opensuse build service 2.1
    novell opensuse build service 2.1.0
    novell opensuse build service 2.1.1
    novell opensuse build service 2.1.2
    novell opensuse build service 2.1.3
    novell opensuse build service 2.1.4
    novell opensuse build service 2.1.5
    novell opensuse build service *
    novell opensuse 11.3