Cisco WLSE archiveApplyDisplay.jsp跨站脚本漏洞

CVE编号

CVE-2006-1961

利用情况

暂无

补丁情况

N/A

披露时间

2006-04-21

漏洞描述

Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://secunia.com/advisories/19736
http://secunia.com/advisories/19739
http://secunia.com/advisories/19741
http://securitytracker.com/id?1015965
http://www.assurance.com.au/advisories/200604-cisco.txt
http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml
http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml
http://www.osvdb.org/24813
http://www.securityfocus.com/archive/1/431367/30/5490/threaded
http://www.securityfocus.com/archive/1/431371/30/5490/threaded
http://www.securityfocus.com/bid/17609
http://www.vupen.com/english/advisories/2006/1434
http://www.vupen.com/english/advisories/2006/1435
https://exchange.xforce.ibmcloud.com/vulnerabilities/25884

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	cisco	ciscoworks_2000_service_management_solution	*	-
	运行在以下环境
	应用	cisco	user_registration_tool	*	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.0	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.1	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.10	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.11	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.12	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.13	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.2	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.3	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.4	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.5	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.6	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.7	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.8	-
	运行在以下环境
	应用	cisco	wireless_lan_solution_engine	2.9	-
	运行在以下环境
	系统	cisco	ethernet_subscriber_solution_engine	*	-
	运行在以下环境
	硬件	cisco	hosting_solution_engine	1.7	-
	运行在以下环境
	硬件	cisco	hosting_solution_engine	1.7.0	-
	运行在以下环境
	硬件	cisco	hosting_solution_engine	1.7.1	-
	运行在以下环境
	硬件	cisco	hosting_solution_engine	1.7.2	-
	运行在以下环境
	硬件	cisco	hosting_solution_engine	1.7.3	-

CVSS3评分 7.5

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 部分地
• 保密性 部分地
• 完整性 部分地

AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-ID	漏洞类型
NVD-CWE-Other

Exp相关链接

- avd.aliyun.com