VulnerabilityModified

CVE-2010-1905

Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl…

MEDIUM 4.3EPSS 2.48%

Does this matter?

Lower severity and a low EPSS score (2.48%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 2.48% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: consona/consona live assistance · consona/consona dynamic agent · consona/consona subscriber assistance
Source: cve@mitre.org

References

http://secunia.com/advisories/39740Vendor Advisory
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdfPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/602801Patch, US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded
http://www.securityfocus.com/bid/39999Exploit
http://www.wintercore.com/downloads/rootedcon_0day.pdfExploit
http://secunia.com/advisories/39740Vendor Advisory
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdfPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/602801Patch, US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded
http://www.securityfocus.com/bid/39999Exploit
http://www.wintercore.com/downloads/rootedcon_0day.pdfExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.