CVE-2011-2694

Loading...

General

Score:2.6/10.0
Severity:Low
Category:XSS Injection
Exploit:Available

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:High
Authentication:None

Relative vulnerabilities

CVE-2007-2444, CVE-2007-2446, CVE-2007-2447, CVE-2008-1105, CVE-2008-3789, CVE-2008-4314, CVE-2009-2813, CVE-2009-2906, CVE-2009-2948, CVE-2009-3297, CVE-2010-0547, CVE-2010-0728, CVE-2010-0787, CVE-2010-0926, CVE-2010-1642, CVE-2010-2063, CVE-2010-3069, CVE-2011-0547, CVE-2011-0719, CVE-2011-1678, CVE-2011-2522, CVE-2011-2724, CVE-2012-0870, CVE-2012-1182, CVE-2012-2111, CVE-2012-6150, CVE-2013-0213, CVE-2013-0214, CVE-2013-4124, CVE-2013-4408, CVE-2013-4475, CVE-2013-4496, CVE-2013-6442, CVE-2014-0244, CVE-2014-3493, CVE-2015-0240, CVE-2015-5252, CVE-2015-5296, CVE-2015-5299, CVE-2015-5330, CVE-2015-5370, CVE-2015-7560, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2115, CVE-2016-2118, CVE-2016-2125, CVE-2016-2126, CVE-2017-12150, CVE-2017-12163, CVE-2017-2619, CVE-2017-7494, CVE-2018-1050

Published on 29/07/11 - Updated on 30/10/18

Description

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

Category: XSS Injection

CWE-79 (Cross-Site Scripting (XSS))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Security Notices

US National Vulnerability DatabaseCVE-2011-2694
Agence Nationale de la Sécurité des Systèmes d'Information CERTA-2011-AVI-416, CERTA-2012-AVI-046
CentOS CESA-2011:1219, CESA-2011:1220
Debian DSA-2290-1
Oracle Linux ELSA-2011-1219, ELSA-2011-1220, ELSA-2011-1221, ELSA-2012-0313, ELSA-2017-0662, ELSA-2018-1860
Redhat RHSA-2011:1219, RHSA-2011:1220, RHSA-2011:1221
SUSE SUSE-SU-2012:0348

Exploits

SecurityFocusBID-48901

Relative technologies

VendorProduct
sambasamba

Share this vulnerability with:

Twitter Facebook LinkedIn Mail