CVEvulnerability
CVE-2010-1905
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-05-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to sdccommon/verify/asp/n6plugindestructor.asp.
Affected configurations
• consona consona live assistance
• consona consona dynamic agent
• consona consona subscriber assistance
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secunia.com/advisories/39740 Vendor Advisory
- http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html wintercore.com
- http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/602801 Patch, US Government Resource
- http://www.securityfocus.com/archive/1/511176/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/39999 Exploit
- http://www.wintercore.com/downloads/rootedcon_0day.pdf Exploit
- http://secunia.com/advisories/39740 Vendor Advisory
- http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html wintercore.com
- http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/602801 Patch, US Government Resource
- http://www.securityfocus.com/archive/1/511176/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/39999 Exploit
- http://www.wintercore.com/downloads/rootedcon_0day.pdf Exploit