CVE-2010-2267 - Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name parameter to httpdcfg.cgi, or (4) the dns parameter to servercfg.cgi

Back Back to CVE browser

MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name parameter to httpdcfg.cgi, or (4) the dns parameter to servercfg.cgi

Published Jun 14, 2010

4.3

MEDIUM

CVSS 2.0

EPSS 0.94%

Description

Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name parameter to httpdcfg.cgi, or (4) the dns parameter to servercfg.cgi.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

http://www.ioactive.com/pdfs/AccoriaWebServer.pdf
x_refsource_MISCExploit
http://www.kb.cert.org/vuls/id/245081
third-party-advisoryx_refsource_CERT-VNUS Government Resource

Link	Providers	Tags
http://www.ioactive.com/pdfs/AccoriaWebServer.pdf		x_refsource_MISCExploit
http://www.kb.cert.org/vuls/id/245081		third-party-advisoryx_refsource_CERT-VNUS Government Resource