8135Third-party advisory
http://securityreason.com/securityalert/8135 CVE-2011-1427
Kodak InSite 5.5.2 - '/Troubleshooting/DiagnosticReport.asp?HeaderWarning' Cross-Site Scripting
Record summary
CVE-2011-1427 has a selected CVSS score of 4.3; EIP currently links 2 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, or (3) User-Agent header to troubleshooting/speedtest.asp.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBKodak InSite 5.5.2 - '/Troubleshooting/DiagnosticReport.asp?HeaderWarning' Cross-Site ScriptingExploitDB exploitby DionachNot analyzed1 file
ExploitDBKodak InSite 5.5.2 - '/Pages/login.aspx?Language' Cross-Site ScriptingExploitDB exploitby DionachNot analyzed1 file
References
620110307 InSite Troubleshooting Cross-Site Scriptingmailing list
http://www.securityfocus.com/archive/1/516880/100/0/threaded 20110307 Kodak InSite Login Page Cross-Site Scriptingmailing list
http://www.securityfocus.com/archive/1/516881/100/0/threaded 46762vdb entry
http://www.securityfocus.com/bid/46762 kodakinsite-multiple-xss(65941)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/65941 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2011-1427