CVE-2015-10010

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-10010
A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd Patch Third Party Advisory
https://vuldb.com/?ctiid.217196 Permissions Required Third Party Advisory
https://vuldb.com/?id.217196 Permissions Required Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:openresolve:*:*:*:*:*:*:*:*
History

11 Apr 2024, 00:52

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en OpenDNS OpenResolve. Ha sido calificada como problemática. La función get del archivo resolverapi/endpoints.py del componente API es afectada por esta vulnerabilidad. La manipulación conduce a cross-site scripting. El ataque puede lanzarse de forma remota. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. El nombre del parche es c680170d5583cd9342fe1af43001fe8b2b8004dd. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-217196.

07 Nov 2023, 02:23

Type Values Removed Values Added
CWE CWE-79

20 Oct 2023, 08:15

Type Values Removed Values Added
Summary A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196. A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
CWE CWE-79

09 Jan 2023, 19:06

Type Values Removed Values Added
First Time Cisco openresolve
Cisco
CPE cpe:2.3:a:cisco:openresolve:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
References (MISC) https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd - (MISC) https://github.com/opendns/OpenResolve/commit/c680170d5583cd9342fe1af43001fe8b2b8004dd - Patch, Third Party Advisory
References (MISC) https://vuldb.com/?id.217196 - (MISC) https://vuldb.com/?id.217196 - Permissions Required, Third Party Advisory
References (MISC) https://vuldb.com/?ctiid.217196 - (MISC) https://vuldb.com/?ctiid.217196 - Permissions Required, Third Party Advisory

02 Jan 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-02 21:15

Updated : 2024-04-11 00:52

NVD link : CVE-2015-10010

Mitre link : CVE-2015-10010

CVE.ORG link : CVE-2015-10010

JSON object : View

Products Affected

cisco

  • openresolve
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')