Sign-up

ID

VAR-201505-0171


CVE

CVE-2015-0724


TITLE

Cisco Headend Digital Broadband Delivery System of dncs Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2015-002703

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCur25604. The system provides features such as content protection, video on demand and dbd backup and restore. dncs is one of the security systems that provide remote management integration and scalability

Trust: 1.98

sources: NVD: CVE-2015-0724 // JVNDB: JVNDB-2015-002703 // BID: 74621 // VULHUB: VHN-78670

AFFECTED PRODUCTS

vendor:ciscomodel:headend digital broadband delivery systemscope:eqversion: -

Trust: 1.6

vendor:ciscomodel:headend digital broadband delivery systemscope:eqversion:(dncs 7.0.0.12)

Trust: 0.8

vendor:ciscomodel:headend digital broadband delivery systemscope:eqversion:0

Trust: 0.3

sources: BID: 74621 // JVNDB: JVNDB-2015-002703 // CNNVD: CNNVD-201505-234 // NVD: CVE-2015-0724

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0724
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-0724
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201505-234
value: MEDIUM

Trust: 0.6

VULHUB: VHN-78670
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-0724
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-78670
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78670 // JVNDB: JVNDB-2015-002703 // CNNVD: CNNVD-201505-234 // NVD: CVE-2015-0724

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-78670 // JVNDB: JVNDB-2015-002703 // NVD: CVE-2015-0724

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-234

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201505-234

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002703

PATCH
title:38767url:http://tools.cisco.com/security/center/viewAlert.x?alertId=38767
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-002703

EXTERNAL IDS
db:NVDid:CVE-2015-0724
Trust: 2.8
db:SECTRACKid:1032304
Trust: 1.1
db:JVNDBid:JVNDB-2015-002703
Trust: 0.8
db:CNNVDid:CNNVD-201505-234
Trust: 0.7
db:BIDid:74621
Trust: 0.4
db:VULHUBid:VHN-78670
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78670 // 
            
            
            
            BID: 74621 // 
            
            
            
            JVNDB: JVNDB-2015-002703 // 
            
            
            
            CNNVD: CNNVD-201505-234 // 
            
            
            
            NVD: CVE-2015-0724

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=38767
Trust: 2.0
url:http://www.securitytracker.com/id/1032304
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0724
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0724
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-78670 // 
            
            
            
            BID: 74621 // 
            
            
            
            JVNDB: JVNDB-2015-002703 // 
            
            
            
            CNNVD: CNNVD-201505-234 // 
            
            
            
            NVD: CVE-2015-0724

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 74621

SOURCES
db:VULHUBid:VHN-78670
db:BIDid:74621
db:JVNDBid:JVNDB-2015-002703
db:CNNVDid:CNNVD-201505-234
db:NVDid:CVE-2015-0724

LAST UPDATE DATE
2025-04-13T23:23:45.069000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78670date:2017-01-06T00:00:00
db:BIDid:74621date:2015-05-12T00:00:00
db:JVNDBid:JVNDB-2015-002703date:2015-05-19T00:00:00
db:CNNVDid:CNNVD-201505-234date:2015-05-15T00:00:00
db:NVDid:CVE-2015-0724date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-78670date:2015-05-15T00:00:00
db:BIDid:74621date:2015-05-12T00:00:00
db:JVNDBid:JVNDB-2015-002703date:2015-05-19T00:00:00
db:CNNVDid:CNNVD-201505-234date:2015-05-15T00:00:00
db:NVDid:CVE-2015-0724date:2015-05-15T01:59:03.173