CVE-2010-0541

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page.

References

http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html

http://secunia.com/advisories/40220

http://support.apple.com/kb/HT4188

http://www.mandriva.com/security/advisories?name=MDVSA-2011:097

http://www.mandriva.com/security/advisories?name=MDVSA-2011:098

http://www.redhat.com/support/errata/RHSA-2011-0908.html

http://www.redhat.com/support/errata/RHSA-2011-0909.html

http://www.securityfocus.com/bid/40871

http://www.securityfocus.com/bid/40895

http://www.vupen.com/english/advisories/2010/1481

Details

Source: MITRE

Published: 2010-06-17

Updated: 2012-11-06

Type: CWE-79

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
75729openSUSE Security Update : ruby (openSUSE-SU-2011:0561-1)NessusSuSE Local Security Checks
medium
68298Oracle Linux 5 : ruby (ELSA-2011-0909)NessusOracle Linux Local Security Checks
medium
68297Oracle Linux 4 : ruby (ELSA-2011-0908)NessusOracle Linux Local Security Checks
medium
67085CentOS 5 : ruby (CESA-2011:0909)NessusCentOS Local Security Checks
medium
61076Scientific Linux Security Update : ruby on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
61075Scientific Linux Security Update : ruby on SL4.x i386/x86_64NessusScientific Linux Local Security Checks
medium
58146Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : ruby1.8 vulnerabilities (USN-1377-1)NessusUbuntu Local Security Checks
high
55837CentOS 4 : ruby (CESA-2011:0908)NessusCentOS Local Security Checks
medium
55451RHEL 5 : ruby (RHSA-2011:0909)NessusRed Hat Local Security Checks
medium
55450RHEL 4 : ruby (RHSA-2011:0908)NessusRed Hat Local Security Checks
medium
54921SuSE 11.1 Security Update : ruby (SAT Patch Number 4585)NessusSuSE Local Security Checks
medium
54626Mandriva Linux Security Advisory : ruby (MDVSA-2011:097)NessusMandriva Local Security Checks
medium
48419Fedora 14 : ruby-1.8.7.302-1.fc14 (2010-13401)NessusFedora Local Security Checks
medium
48417Fedora 13 : ruby-1.8.6.399-6.fc13 (2010-13387)NessusFedora Local Security Checks
medium
48416Fedora 12 : ruby-1.8.6.399-6.fc12 (2010-13341)NessusFedora Local Security Checks
medium
48370FreeBSD : ruby -- UTF-7 encoding XSS vulnerability in WEBrick (34e0316a-aa91-11df-8c2e-001517289bf8)NessusFreeBSD Local Security Checks
medium
800793Mac OS X 10.6 < 10.6.4 Multiple VulnerabilitiesLog Correlation EngineOperating System Detection
high
5571Mac OS X 10.6 < 10.6.4 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
47024Mac OS X Multiple Vulnerabilities (Security Update 2010-004)NessusMacOS X Local Security Checks
high
47023Mac OS X 10.6.x < 10.6.4 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high