[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201407241926.s6OJQkbM005862@linus.mitre.org>
Date: Thu, 24 Jul 2014 15:26:46 -0400 (EDT)
From: cve-assign@...re.org
To: adan.alvarez.90@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Duplicated CVE - Cacti XSS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I requested a CVE to mitre
>
> CVE-2014-5043.
>
> another XSS vulnerability that is not solved by the current patch.
>
> Here you have the details to reproduce it:
>
> Create a new user or edit an existing one with the following Full
> Name: [XSS] Then go to System Utilities - View User Log, and if the
> user has logged in you will see a popup with the text "XSS".
>
> Maybe the CVE-2014-5043 can by used to identify this last discovery.
Yes, this is what we will do. CVE-2014-5043 was not previously bound
to any conflicting public vulnerability information, so we will
establish the public scope of CVE-2014-5043 as exclusively this new
"System Utilities - View User Log" XSS issue. Our understanding is
that this crosses privilege boundaries because the attacker must have
"User Administration" enabled under "Realm Permissions" but the
attacker does not need to have all of the Realm Permissions. If this
is incorrect and "User Administration" is always equivalent to the
"admin" user at all Cacti sites, then this CVE wouldn't be needed.
In any case, http://www.openwall.com/lists/oss-security/2014/07/22/9
still defines the meaning of CVE-2014-5025 and CVE-2014-5026.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJT0V1ZAAoJEKllVAevmvms1I8H/ig+KhutHxd5FBmV0V3Id9bj
5uxkBIIKw6kA7LM5KU8bnAc6PeE5Xg2N8GJCL5wlysGluCAT+Dbco2X8Nvsi4RUG
AM3Z/WcxTA+duHpRea2Cd9W3PRGnx42vQDFAuIB44MLKjHtlENasic6BauBw+gy6
F6CrX463/o6A5fXu1U7PMEKRKwIRozdLxuTrEJhhUJe012sRchQRvDme2nKtHOz5
woCD8BPh8t5iO5TPzAI0+Fc8EQMduN2RpvsQhZanYZDjVdnCayi2p/at02RDk/Xq
OoOVDBue0T4smnH50qNYYSknn0e0C9zSlXUefL54JNO+7qoqbDzHt1vNFmw3io0=
=mGH4
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
