CVE-2011-5178 : Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/l

Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) eulaAccepted or (2) mode parameter.

Published 2012-09-20 10:55:24

Updated 2025-04-11 00:51:22

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2011-5178

Infoblox » Netmri
Versions up to, including, (<=) 6.2.1
cpe:2.3:a:infoblox:netmri:*:*:*:*:*:*:*:*
Matching versions
Infoblox » Netmri » Version: 6.0.2.42
cpe:2.3:a:infoblox:netmri:6.0.2.42:*:*:*:*:*:*:*
Matching versions
Infoblox » Netmri » Version: 6.1.2
cpe:2.3:a:infoblox:netmri:6.1.2:*:*:*:*:*:*:*
Matching versions
Infoblox » Netmri » Version: 6.2.1.48
cpe:2.3:a:infoblox:netmri:6.2.1.48:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-5178

EPSS FAQ

0.67%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 69 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-5178

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2011-5178

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-5178

http://foregroundsecurity.com/secure-coding-and-security-qa/111-infoblox-netmri-621-612-and-60242-multiple-cross-site-scripting-xss

Raytheon Foreground Security (RFS) - Foreground Security has now been integrated into Raytheon’s portfolio of cybersecurity services | Raytheon
Exploit
http://www.infoblox.com/community/downloads/hotfix-v621-netmri-8831gpg

Home - Infoblox Experts Community
Vendor Advisory
http://seclists.org/fulldisclosure/2011/Nov/158

Full Disclosure: [FOREGROUND SECURITY 2011-004] Infoblox NetMRI 6.2.1 Multiple Cross-Site Scripting (XSS) vulnerabilities
Exploit
http://www.infoblox.com/community/downloads/hotfix-v612-netmri-8831gpg

Home - Infoblox Experts Community
Vendor Advisory
http://www.securitytracker.com/id?1026319

Infoblox NetMRI Input Validation Flaw in Login Page Permits Cross-Site Scripting Attacks - SecurityTracker
Exploit
http://secunia.com/advisories/46854

Sign in
Vendor Advisory
http://www.infoblox.com/community/downloads/hotfix-v602-netmri-8831gpg

Home - Infoblox Experts Community
Vendor Advisory

Jump to

Vulnerability Details : CVE-2011-5178

Products affected by CVE-2011-5178

Exploit prediction scoring system (EPSS) score for CVE-2011-5178

CVSS scores for CVE-2011-5178

CWE ids for CVE-2011-5178

References for CVE-2011-5178