CVE-2011-2694
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username…
Does this matter?
Lower severity and a low EPSS score (6.05%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
- EPSS
- 6.05% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- samba/samba · canonical/ubuntu linux · debian/debian linux
- Source
- secalert@redhat.com
References
- http://jvn.jp/en/jp/JVN63041502/index.htmlThird Party Advisory
- http://osvdb.org/74072Broken Link
- http://samba.org/samba/history/samba-3.5.10.htmlVendor Advisory
- http://secunia.com/advisories/45393Not Applicable, Vendor Advisory
- http://secunia.com/advisories/45488Not Applicable, Third Party Advisory
- http://secunia.com/advisories/45496Not Applicable, Third Party Advisory
- http://securitytracker.com/id?1025852Broken Link, Third Party Advisory, VDB Entry
- http://ubuntu.com/usn/usn-1182-1Third Party Advisory
- http://www.debian.org/security/2011/dsa-2290Third Party Advisory
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543Broken Link, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:121Broken Link
- http://www.samba.org/samba/security/CVE-2011-2694Vendor Advisory
- http://www.securityfocus.com/bid/48901Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=722537Issue Tracking, Patch
- https://bugzilla.samba.org/show_bug.cgi?id=8289Issue Tracking, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68844Third Party Advisory, VDB Entry
- http://jvn.jp/en/jp/JVN63041502/index.htmlThird Party Advisory
- http://osvdb.org/74072Broken Link
- http://samba.org/samba/history/samba-3.5.10.htmlVendor Advisory
- http://secunia.com/advisories/45393Not Applicable, Vendor Advisory
- http://secunia.com/advisories/45488Not Applicable, Third Party Advisory
- http://secunia.com/advisories/45496Not Applicable, Third Party Advisory
- http://securitytracker.com/id?1025852Broken Link, Third Party Advisory, VDB Entry
- http://ubuntu.com/usn/usn-1182-1Third Party Advisory
- http://www.debian.org/security/2011/dsa-2290Third Party Advisory
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543Broken Link, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:121Broken Link
- http://www.samba.org/samba/security/CVE-2011-2694Vendor Advisory
- http://www.securityfocus.com/bid/48901Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=722537Issue Tracking, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.