製品・ソフトウェアに関する情報

JVN脆弱性詳細

OrangeHRM におけるクロスサイトスクリプティングの脆弱性

Title	OrangeHRM におけるクロスサイトスクリプティングの脆弱性
Summary	OrangeHRM には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、下記の項目を介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。 (1) index.php の uniqcode パラメータ (2) index.php の isAdmin パラメータ (3) lib/controllers/centralcontroller.php の PATH_INFO
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 12, 2013, midnight
Registration Date	Feb. 15, 2013, 6:58 p.m.
Last Update	Feb. 15, 2013, 6:58 p.m.

Affected System

OrangeHRM

OrangeHRM 2.6.11.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-5258	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5258
National Vulnerability Database (NVD)
2	CVE-2011-5258	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-5258

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
OrangeHRM
1	Security Vulnerabilities Fixed with OrangeHRM 2.6.11.2	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/
2	Top Page	http://www.orangehrm.com/home.shtml

Change Log

No	Changed Details	Date of change
0	[2013年02月15日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-5258

Summary	Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.
Publication Date	Feb. 13, 2013, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:40 p.m.
Last Update	Nov. 21, 2024, 10:34 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/	Vendor Advisory
2	http://osvdb.org/show/osvdb/77416	Exploit
3	http://osvdb.org/show/osvdb/77417	Exploit
4	http://secunia.com/advisories/47014	Vendor Advisory
5	http://www.securityfocus.com/archive/1/520684/100/0/threaded
6	http://www.securityfocus.com/bid/50857	Exploit
7	https://exchange.xforce.ibmcloud.com/vulnerabilities/71568
8	https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.html	Exploit
9	http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/	Vendor Advisory
10	https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.html	Exploit
11	https://exchange.xforce.ibmcloud.com/vulnerabilities/71568
12	http://www.securityfocus.com/bid/50857	Exploit
13	http://www.securityfocus.com/archive/1/520684/100/0/threaded
14	http://secunia.com/advisories/47014	Vendor Advisory
15	http://osvdb.org/show/osvdb/77417	Exploit
16	http://osvdb.org/show/osvdb/77416	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html