CVE-2015-5460 - Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification

Back Back to CVE browser

MEDIUM

Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification

Published Jul 8, 2015

4.3

MEDIUM

CVSS 2.0

EPSS 2.55%

Description

Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

http://packetstormsecurity.com/files/132552/Snorby-2.6.2-Cross-Site-Scripting.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Jul/15
mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/535930/100/0/threaded
mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/75561
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5416
Advisory
https://github.com/Snorby/snorby/commit/89d7cbcd3697c8a842f1a61b99e9a78f295798fb
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/Snorby/snorby/issues/377
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/132552/Snorby-2.6.2-Cross-Site-Scripting.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Jul/15		mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/535930/100/0/threaded		mailing-listx_refsource_BUGTRAQThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/75561		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5416		Advisory
https://github.com/Snorby/snorby/commit/89d7cbcd3697c8a842f1a61b99e9a78f295798fb		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/Snorby/snorby/issues/377		x_refsource_CONFIRMExploitThird Party Advisory