CVE-2013-2136 Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard...
MediumCVSS 4.3
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cloudstack | <= 4.1.0 | No fix listed |
| apache cloudstack | = 2.0 | No fix listed |
| apache cloudstack | = 2.0.1 | No fix listed |
| apache cloudstack | = 2.1.0 | No fix listed |
| apache cloudstack | = 2.1.1 | No fix listed |
| apache cloudstack | = 2.1.2 | No fix listed |
| apache cloudstack | = 2.1.3 | No fix listed |
| apache cloudstack | = 2.1.4 | No fix listed |
| apache cloudstack | = 2.1.5 | No fix listed |
| apache cloudstack | = 2.1.6 | No fix listed |
| apache cloudstack | = 2.1.7 | No fix listed |
| apache cloudstack | = 2.1.8 | No fix listed |
| apache cloudstack | = 2.1.9 | No fix listed |
| apache cloudstack | = 2.1.10 | No fix listed |
| apache cloudstack | = 2.2.0 | No fix listed |
| apache cloudstack | = 2.2.1 | No fix listed |
| apache cloudstack | = 2.2.2 | No fix listed |
| apache cloudstack | = 2.2.3 | No fix listed |
| apache cloudstack | = 2.2.5 | No fix listed |
| apache cloudstack | = 2.2.6 | No fix listed |
| apache cloudstack | = 2.2.7 | No fix listed |
| apache cloudstack | = 2.2.8 | No fix listed |
| apache cloudstack | = 2.2.9 | No fix listed |
| apache cloudstack | = 2.2.11 | No fix listed |
| apache cloudstack | = 2.2.12 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cloudstack | = 2.2.13 | No fix listed |
| apache cloudstack | = 2.2.14 | No fix listed |
| apache cloudstack | = 3.0.0 | No fix listed |
| apache cloudstack | = 3.0.1 | No fix listed |
| apache cloudstack | = 3.0.2 | No fix listed |
| apache cloudstack | = 4.0.0-incubating | No fix listed |
| apache cloudstack | = 4.0.1 | No fix listed |
| apache cloudstack | = 4.0.2 | No fix listed |
References
- 20130806 [CVE-2013-2136] Apache CloudStack Cross-site scripting (XSS) vulnerabiliity mailing-list
- 20130807 Updated [CVE-2013-2136] Apache CloudStack Cross-site scripting (XSS) vulnerabiliity mailing-list
- 96074 vdb-entry
- 96075 vdb-entry
- 96076 vdb-entry
- 96077 vdb-entry
- 96078 vdb-entry
- 54399 third-party-advisory vendor-advisory
- 61638 vdb-entry
- apache-cloudstack-cve20132136-xss(86258) vdb-entry
- issues.apache.org