Vulnerability Details : CVE-2011-2694
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2011-2694
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
- cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
Threat overview for CVE-2011-2694
Top countries where our scanners detected CVE-2011-2694
Top open port discovered on systems with this issue
8200
IPs affected by CVE-2011-2694 341
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2011-2694!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2011-2694
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-2694
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.6
|
LOW | AV:N/AC:H/Au:N/C:N/I:P/A:N |
4.9
|
2.9
|
NIST |
CWE ids for CVE-2011-2694
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-2694
-
http://www.securityfocus.com/bid/48901
Samba SWAT 'user' Field Cross Site Scripting VulnerabilityThird Party Advisory;VDB Entry
-
http://ubuntu.com/usn/usn-1182-1
USN-1182-1: Samba vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=722537
722537 – (CVE-2011-2694) CVE-2011-2694 samba (SWAT): XSS flaw in Change Password pageIssue Tracking;Patch
-
https://bugzilla.samba.org/show_bug.cgi?id=8289
Bug 8289 – Swat contains a cross-site scripting vulnerability; CVE-2011-2694Issue Tracking;Patch
-
http://www.samba.org/samba/security/CVE-2011-2694
Samba - Security Announcement ArchiveVendor Advisory
-
http://securitytracker.com/id?1025852
Samba Web Administration Tool (SWAT) Input Validation Flaws Permit Cross-Site Request Forgery and Cross-Site Scripting Attacks - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
http://samba.org/samba/history/samba-3.5.10.html
Vendor Advisory
-
http://www.debian.org/security/2011/dsa-2290
Debian -- Security Information -- DSA-2290-1 sambaThird Party Advisory
-
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543
Broken Link;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/68844
Samba user cross-site scripting CVE-2011-2694 Vulnerability ReportThird Party Advisory;VDB Entry
Jump to