CVE-2006-3261 - Cross-site scripting (XSS) vulnerability in Trend Micro Control Manager (TMCM) 3.5 allows remote att

CVE-2006-3261

Summary

Cross-site scripting (XSS) vulnerability in Trend Micro Control Manager (TMCM) 3.5 allows remote attackers to inject arbitrary web script or HTML via the username field on the login page, which is not properly sanitized before being displayed in the error log.

References

http://secunia.com/advisories/20794
http://securityreason.com/securityalert/1159
http://securitytracker.com/id?1016372
http://www.securityfocus.com/archive/1/438158/100/0/threaded
http://www.securityfocus.com/bid/18619
http://www.vupen.com/english/advisories/2006/2526
https://exchange.xforce.ibmcloud.com/vulnerabilities/27388

Vulnerable Configurations

cpe:2.3:a:trend_micro:control_manager:3.5:*:*:*:*:*:*:*
cpe:2.3:a:trend_micro:control_manager:3.5:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 18-10-2018 - 16:46)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	18619
bugtraq	20060623 Trend Micro Control Manager (TMCM) Persistent XSS Vulnerability
sectrack	1016372
secunia	20794
sreason	1159
vupen	ADV-2006-2526
xf	controlmanager-logfile-xss(27388)

Last major update

18-10-2018 - 16:46

Published

27-06-2006 - 21:05

Last modified

18-10-2018 - 16:46