CVE-2013-5300
Last modified
CVE-2013-5300 is a vulnerability of currently unknown severity. Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.. EPSS estimates a 1.79% chance of exploitation in the next 30 days.
Description
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Alienvault | Open Source Security Information Management | <= 4.2.3 |
| Alienvault | Open Source Security Information Management | 1.0.4 |
| Alienvault | Open Source Security Information Management | 1.0.6 |
| Alienvault | Open Source Security Information Management | 2.1 |
| Alienvault | Open Source Security Information Management | 2.1.2 |
| Alienvault | Open Source Security Information Management | 2.1.5 |
| Alienvault | Open Source Security Information Management | 2.1.5-1 |
| Alienvault | Open Source Security Information Management | 2.1.5-2 |
| Alienvault | Open Source Security Information Management | 2.1.5-3 |
| Alienvault | Open Source Security Information Management | 3.1 |
| Alienvault | Open Source Security Information Management | 3.1.9 |
| Alienvault | Open Source Security Information Management | 3.1.10 |
| Alienvault | Open Source Security Information Management | 3.1.12 |
| Alienvault | Open Source Security Information Management | 4.0.3 |
| Alienvault | Open Source Security Information Management | 4.0.4 |
| Alienvault | Open Source Security Information Management | 4.1 |
| Alienvault | Open Source Security Information Management | 4.1.2 |
| Alienvault | Open Source Security Information Management | 4.1.3 |
| Alienvault | Open Source Security Information Management | 4.2 |
| Alienvault | Open Source Security Information Management | 4.2.2 |
References
- http://secunia.com/advisories/54264Vendor Advisory
- http://secunia.com/advisories/54287Vendor Advisory
- http://secunia.com/advisories/54264Vendor Advisory
- http://secunia.com/advisories/54287Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-5300?
How severe is CVE-2013-5300?
How do I fix CVE-2013-5300?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-5294Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5295Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5296Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5297Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5298Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5299Rejected reason: This candidate is unused by its CNA.
- CVE-2013-5301Directory traversal vulnerability in help.php in Trustport W…
- CVE-2013-5302SQL injection vulnerability in the Faceted Search (ke_search…
- CVE-2013-5303Unspecified vulnerability in the Store Locator (locator) ext…
- CVE-2013-5304SQL injection vulnerability in the Store Locator (locator) e…
- CVE-2013-5305Cross-site scripting (XSS) vulnerability in the Store Locato…
- CVE-2013-5306SQL injection vulnerability in the Browser - TYPO3 without P…
Are you affected by CVE-2013-5300?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST