Sign-up

ID

VAR-201110-0139


CVE

CVE-2011-0459


TITLE

Cyber-Ark PIM Suite Password Vault Web Access Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: 8f906106-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-1370

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cyber-Ark Password Vault Web Access (PVWA) 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Password Vault Web Access (PVWA) provided by Cyber-Ark Software, Ltd. contains a cross-site scripting vulnerability. Password Vault Web Access (PVWA) is a module in the Privileged Identity Management Suite that allows access via a web portal. PVWA contains a cross-site scripting vulnerability.An arbitrary script may be executed on the web browser of an user who is logged on. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. ---------------------------------------------------------------------- Q1 Factsheets released: http://secunia.com/resources/factsheets/2011_vendor/ ---------------------------------------------------------------------- TITLE: Cyber-Ark PIM Suite Password Vault Web Access Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA44058 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44058/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44058 RELEASE DATE: 2011-04-09 DISCUSS ADVISORY: http://secunia.com/advisories/44058/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44058/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44058 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Cyber-Ark PIM Suite, which can be exploited by malicious people to conduct cross-site scripting attacks. Please contact the vendor for more information. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: JVN: http://jvn.jp/en/jp/JVN11424086/index.html http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000023.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.7

sources: NVD: CVE-2011-0459 // JVNDB: JVNDB-2011-000023 // CNVD: CNVD-2011-1370 // BID: 47271 // IVD: 8f906106-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 100212

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 8f906106-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-1370

AFFECTED PRODUCTS

vendor:cyber arkmodel:password vault web accessscope:eqversion:6.0

Trust: 1.6

vendor:cyber arkmodel:password vault web accessscope:eqversion:4.0

Trust: 1.6

vendor:cyber arkmodel:password vault web accessscope:eqversion:5.5

Trust: 1.6

vendor:cyber arkmodel:password vault web accessscope:lteversion:5.0

Trust: 1.0

vendor:cyber arkmodel:software password vault web accessscope:eqversion:5.0

Trust: 0.9

vendor:cyber arkmodel:software password vault web access 5.5.patch #4scope: - version: -

Trust: 0.9

vendor:cyber arkmodel:software password vault web access patch #2scope:eqversion:6.0

Trust: 0.9

vendor:cyber arkmodel:password vault web accessscope:lteversion:pvwa v5.0

Trust: 0.8

vendor:cyber arkmodel:password vault web accessscope:lteversion:v5.5 releases v5.5 patch #4

Trust: 0.8

vendor:cyber arkmodel:password vault web accessscope:lteversion:v6.0 releases v6.0 patch #2

Trust: 0.8

vendor:cyber arkmodel:password vault web accessscope:eqversion:5.0

Trust: 0.6

vendor:password vault web accessmodel: - scope:eqversion:5.5

Trust: 0.4

vendor:password vault web accessmodel: - scope:eqversion:6.0

Trust: 0.4

vendor:cyber arkmodel:software password vault web access patch #3scope:neversion:6.0

Trust: 0.3

vendor:cyber arkmodel:software password vault web access patch #5scope:neversion:5.5

Trust: 0.3

vendor:password vault web accessmodel: - scope:eqversion:4.0

Trust: 0.2

vendor:password vault web accessmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 8f906106-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-1370 // BID: 47271 // JVNDB: JVNDB-2011-000023 // CNNVD: CNNVD-201110-032 // NVD: CVE-2011-0459

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0459
value: MEDIUM

Trust: 1.0

IPA: JVNDB-2011-000023
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201110-032
value: MEDIUM

Trust: 0.6

IVD: 8f906106-2354-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2011-0459
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

IPA: JVNDB-2011-000023
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

IVD: 8f906106-2354-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 8f906106-2354-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2011-000023 // CNNVD: CNNVD-201110-032 // NVD: CVE-2011-0459

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2011-000023 // NVD: CVE-2011-0459

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201110-032

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 100212 // CNNVD: CNNVD-201110-032

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-000023

PATCH
title:Privileged Identity Management Suiteurl:http://www.cyber-ark.com/digital-vault-products/pim-suite/index.asp
Trust: 0.8
title:Cyber-Ark PIM Suite Password Vault Web Access Cross-Site Scripting Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/3473
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-1370 // 
            
            
            
            JVNDB: JVNDB-2011-000023

EXTERNAL IDS
db:NVDid:CVE-2011-0459
Trust: 3.5
db:JVNDBid:JVNDB-2011-000023
Trust: 3.4
db:JVNid:JVN11424086
Trust: 2.8
db:BIDid:47271
Trust: 1.9
db:SECUNIAid:44058
Trust: 1.9
db:CNVDid:CNVD-2011-1370
Trust: 0.8
db:CNNVDid:CNNVD-201110-032
Trust: 0.8
db:JVNid:JVN#11424086
Trust: 0.6
db:IVDid:8F906106-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:100212
Trust: 0.1
sources:
            
            
            IVD: 8f906106-2354-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2011-1370 // 
            
            
            
            BID: 47271 // 
            
            
            
            JVNDB: JVNDB-2011-000023 // 
            
            
            
            PACKETSTORM: 100212 // 
            
            
            
            CNNVD: CNNVD-201110-032 // 
            
            
            
            NVD: CVE-2011-0459

REFERENCES
url:http://jvn.jp/en/jp/jvn11424086/index.html
Trust: 2.8
url:http://www.securityfocus.com/bid/47271
Trust: 1.6
url:http://secunia.com/advisories/44058
Trust: 1.6
url:http://jvndb.jvn.jp/jvndb/jvndb-2011-000023
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0459
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0459
Trust: 0.8
url:http://jvndb.jvn.jp/en/contents/2011/jvndb-2011-000023.htmlhttp
Trust: 0.6
url:http://jvndb.jvn.jp/en/contents/2011/jvndb-2011-000023.html
Trust: 0.4
url:http://www.cyber-ark.com/
Trust: 0.3
url:http://secunia.com/advisories/44058/#comments
Trust: 0.1
url:http://secunia.com/advisories/44058/
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=44058
Trust: 0.1
url:http://secunia.com/resources/factsheets/2011_vendor/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2011-1370 // 
            
            
            
            BID: 47271 // 
            
            
            
            JVNDB: JVNDB-2011-000023 // 
            
            
            
            PACKETSTORM: 100212 // 
            
            
            
            CNNVD: CNNVD-201110-032 // 
            
            
            
            NVD: CVE-2011-0459

CREDITS
Reported by the vendor.
Trust: 0.3
sources:
            
            
            BID: 47271

SOURCES
db:IVDid:8f906106-2354-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-1370
db:BIDid:47271
db:JVNDBid:JVNDB-2011-000023
db:PACKETSTORMid:100212
db:CNNVDid:CNNVD-201110-032
db:NVDid:CVE-2011-0459

LAST UPDATE DATE
2025-04-11T23:08:57.109000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2011-1370date:2011-04-11T00:00:00
db:BIDid:47271date:2011-04-08T00:00:00
db:JVNDBid:JVNDB-2011-000023date:2011-04-08T00:00:00
db:CNNVDid:CNNVD-201110-032date:2011-10-09T00:00:00
db:NVDid:CVE-2011-0459date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:8f906106-2354-11e6-abef-000c29c66e3ddate:2011-04-11T00:00:00
db:CNVDid:CNVD-2011-1370date:2011-04-11T00:00:00
db:BIDid:47271date:2011-04-08T00:00:00
db:JVNDBid:JVNDB-2011-000023date:2011-04-08T00:00:00
db:PACKETSTORMid:100212date:2011-04-09T10:42:38
db:CNNVDid:CNNVD-201110-032date:2011-10-09T00:00:00
db:NVDid:CVE-2011-0459date:2011-10-05T02:56:24.583