CVE - CVE-2005-3921

CVE-ID
CVE-2005-3921	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Cross-site scripting (XSS) vulnerability in Cisco IOS Web Server for IOS 12.0(2a) allows remote attackers to inject arbitrary web script or HTML by (1) packets containing HTML that an administrator views via an HTTP interface to the contents of memory buffers, as demonstrated by the URI /level/15/exec/-/buffers/assigned/dump; or (2) sending the router Cisco Discovery Protocol (CDP) packets with HTML payload that an administrator views via the CDP status pages. NOTE: these vectors were originally reported as being associated with the dump and packet options in /level/15/exec/-/show/buffers.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:15602 URL:http://www.securityfocus.com/bid/15602 BID:16291 URL:http://www.securityfocus.com/bid/16291 BUGTRAQ:20051128 - Cisco IOS HTTP Server code injection/execution vulnerability- URL:http://www.securityfocus.com/archive/1/417916/100/0/threaded CISCO:20051201 IOS HTTP Server Command Injection Vulnerability URL:http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml IDEFENSE:20060117 Cisco Systems IOS 11 Web Service CDP Status Page Code Injection Vulnerability URL:http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372 MISC:http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.html OVAL:oval:org.mitre.oval:def:5867 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5867 SECTRACK:1015275 URL:http://securitytracker.com/id?1015275 SECUNIA:17780 URL:http://secunia.com/advisories/17780 SECUNIA:18528 URL:http://secunia.com/advisories/18528 SREASON:227 URL:http://securityreason.com/securityalert/227 VUPEN:ADV-2005-2657 URL:~~http://www.vupen.com/english/advisories/2005/2657~~ (Obsolete source)
Assigning CNA
MITRE Corporation
Date Record Created
20051130	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20051130)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)