CVE-2015-10010 - OpenDNS OpenResolve API endpoints.py get cross site scripting

Back Back to CVE browser

MEDIUM

OpenDNS OpenResolve API endpoints.py get cross site scripting

Published Jan 2, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.56%

Description

A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.

Affected products

Vendor OpenDNS Product OpenResolve Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenDNS

OpenResolve

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1028
Advisory
https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd
patchThird Party Advisory
https://vuldb.com/?ctiid.217196
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.217196
vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1028		Advisory
https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd		patchThird Party Advisory
https://vuldb.com/?ctiid.217196		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.217196		vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory