Vulnerability Details : CVE-2012-1410
Potential exploit
Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2012-1410
- cpe:2.3:a:kadu:kadu:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:kadu:kadu:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:kadu:kadu:0.9.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-1410
0.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-1410
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2012-1410
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1410
-
https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6
Patch
-
https://bugzilla.redhat.com/show_bug.cgi?id=797777
797777 – (CVE-2012-1410) CVE-2012-1410 kadu: Stored XSS by parsing contact's status and sms messages in historyPatch
-
https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52
Exploit;Patch
-
https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84
Exploit;Patch
-
https://bugzilla.novell.com/show_bug.cgi?id=749036
Bug 749036 – VUL-0: kadu: allows to inject js code into hisotryPatch
-
http://www.openwall.com/lists/oss-security/2012/02/27/3
oss-security - CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in historyPatch
-
https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0
Patch
-
http://www.openwall.com/lists/oss-security/2012/02/27/26
oss-security - Re: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history
Jump to