var-201402-0268
Vulnerability from variot

Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. (CWE-79). Dell Provided by KACE K1000 Contains a cross-site scripting vulnerability. FlatNuke is a web content management system (CMS) based on text files. When a user browses an affected website, their browser will execute arbitrary script code provided by the attacker, which may cause the attacker to steal cookie-based authentication and launch other attacks. There are vulnerabilities in FlatNuke version 3.1.2, other versions may also be affected. Dell KACE K1000 is a set of IT equipment management solutions in the KACE system management series of Dell (Dell). This solution provides functions such as software distribution, configuration management, patch installation, and security vulnerability remediation. The vulnerability is caused by the fact that the adminui/user_list.php page does not sufficiently filter the 'LABEL_ID' parameter

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201402-0268",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "kace k1000 systems management appliance software",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "dell",
        "version": "5.5.90545"
      },
      {
        "model": "kace k1000 systems management appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "dell computer",
        "version": null
      },
      {
        "model": "kace k1000 systems management appliance",
        "scope": null,
        "trust": 0.8,
        "vendor": "dell",
        "version": null
      },
      {
        "model": "kace k1000 systems management appliance software",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "dell",
        "version": "version 5.5.90545"
      },
      {
        "model": "flatnuke",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "flatnuke",
        "version": "3.1.2"
      },
      {
        "model": "flatnuke",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "flatnuke",
        "version": "3.1.3"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:dell:kace_k1000_systems_management_appliance",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:dell:kace_k1000_systems_management_appliance_software",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Canberk Bolat.",
    "sources": [
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2014-0330",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2014-0330",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT DEFINED",
            "baseScore": 4.3,
            "collateralDamagePotential": "NOT DEFINED",
            "confidentialityImpact": "PARTIAL",
            "confidentialityRequirement": "NOT DEFINED",
            "enviromentalScore": 3.5,
            "exploitability": "UNPROVEN",
            "exploitabilityScore": 8.6,
            "id": "CVE-2014-0330",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT DEFINED",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "remediationLevel": "WORKAROUND",
            "reportConfidence": "CONFIRMED",
            "severity": "MEDIUM",
            "targetDistribution": "NOT DEFINED",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-67823",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-0330",
            "trust": 1.6,
            "value": "MEDIUM"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0330",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201402-082",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-67823",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter.  (CWE-79). Dell Provided by KACE K1000 Contains a cross-site scripting vulnerability. FlatNuke is a web content management system (CMS) based on text files. When a user browses an affected website, their browser will execute arbitrary script code provided by the attacker, which may cause the attacker to steal cookie-based authentication and launch other attacks. There are vulnerabilities in FlatNuke version 3.1.2, other versions may also be affected. Dell KACE K1000 is a set of IT equipment management solutions in the KACE system management series of Dell (Dell). This solution provides functions such as software distribution, configuration management, patch installation, and security vulnerability remediation. The vulnerability is caused by the fact that the adminui/user_list.php page does not sufficiently filter the \u0027LABEL_ID\u0027 parameter",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      },
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "BID",
        "id": "65333"
      },
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      }
    ],
    "trust": 3.51
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#813382",
        "trust": 3.9
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "65333",
        "trust": 1.4
      },
      {
        "db": "OSVDB",
        "id": "102855",
        "trust": 1.1
      },
      {
        "db": "BID",
        "id": "65309",
        "trust": 0.9
      },
      {
        "db": "JVN",
        "id": "JVNVU95114228",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "db": "BID",
        "id": "65333"
      },
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "id": "VAR-201402-0268",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T22:08:23.125000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Dell KACE K1000 Systems Management Appliance",
        "trust": 0.8,
        "url": "http://www.kace.com/jp/products/systems-management-appliance"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 2.7
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "http://www.kb.cert.org/vuls/id/813382"
      },
      {
        "trust": 1.6,
        "url": "http://www.kace.com/support/resources/kb/solutiondetail?sol=sol120154"
      },
      {
        "trust": 1.4,
        "url": "http://www.kace.com/products/systems-management-appliance"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/65333"
      },
      {
        "trust": 1.1,
        "url": "http://osvdb.org/102855"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90954"
      },
      {
        "trust": 0.8,
        "url": "http://cwe.mitre.org/data/definitions/79.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0330"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu95114228/"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0330"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/65309"
      },
      {
        "trust": 0.3,
        "url": "http://flatnuke.netsons.org/index.php?action=viewnews\u0026news=1387985445"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "db": "BID",
        "id": "65333"
      },
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "db": "BID",
        "id": "65333"
      },
      {
        "db": "BID",
        "id": "65309"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-04T00:00:00",
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "date": "2014-02-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "date": "2014-02-04T00:00:00",
        "db": "BID",
        "id": "65333"
      },
      {
        "date": "2014-01-29T00:00:00",
        "db": "BID",
        "id": "65309"
      },
      {
        "date": "2014-02-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "date": "2014-01-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "date": "2014-02-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "date": "2014-02-06T23:55:03.993000",
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-11T00:00:00",
        "db": "CERT/CC",
        "id": "VU#813382"
      },
      {
        "date": "2018-01-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-67823"
      },
      {
        "date": "2014-02-04T00:00:00",
        "db": "BID",
        "id": "65333"
      },
      {
        "date": "2014-01-29T00:00:00",
        "db": "BID",
        "id": "65309"
      },
      {
        "date": "2014-02-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001310"
      },
      {
        "date": "2014-02-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "date": "2014-02-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      },
      {
        "date": "2024-11-21T02:01:53.597000",
        "db": "NVD",
        "id": "CVE-2014-0330"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell KACE K1000 management appliance contains a cross-site scripting vulnerability",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#813382"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-361"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201402-082"
      }
    ],
    "trust": 1.2
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.