CVE-2013-5223D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
Aktif olarak istismar ediliyor — D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-5223
Açıklama
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to sntpcfg.cgi, username parameter to (2) ddnsmngr.cmd or (3) todmngr.tod, (4) TodUrlAdd parameter to urlfilter.cmd, (5) appName parameter to scprttrg.cmd, (6) fltName in an add action or (7) rmLst parameter in a remove action to scoutflt.cmd, (8) groupName parameter to portmapcfg.cmd, (9) snmpRoCommunity parameter to snmpconfig.cgi, (10) fltName parameter to scinflt.cmd, (11) PolicyName in an add action or (12) rmLst parameter in a remove action to prmngr.cmd, (13) ippName parameter to ippcfg.cmd, (14) smbNetBiosName or (15) smbDirName parameter to samba.cgi, or (16) wlSsid parameter to wlcfg.wl.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| dlink | dsl-2760u firmware | < 1.12 |
Kaynaklar ve yamalar
- 99611 vdb-entryBroken Link
- 99609 vdb-entryBroken Link
- dlink-cve20135223-xss(88723) vdb-entryThird Party AdvisoryVDB Entry
- dlink-cve20135223-multiple-xss(88724) vdb-entryThird Party AdvisoryVDB Entry
- 99605 vdb-entryBroken Link
- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10002 Vendor Advisory
- 99607 vdb-entryBroken Link
- 99608 vdb-entryBroken Link
- 99606 vdb-entryBroken Link
- 99610 vdb-entryBroken Link
- 99604 vdb-entryBroken Link
- 99615 vdb-entryBroken Link
- 20131110 D-Link Router 2760N (DSL-2760U-BN) Multiple XSS mailing-listExploitMailing ListThird Party Advisory
- 99603 vdb-entryBroken Link
- 99612 vdb-entryBroken Link
- 99616 vdb-entryBroken Link
- http://packetstormsecurity.com/files/123976 ExploitThird Party AdvisoryVDB Entry
- 99613 vdb-entryBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-5223 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:o:dlink:dsl-2760u_firmware:*:*:*:*:*:*:*:*< 1.12