CVE-2011-2694

CVE Details

Release Date:

2011-07-29

Description

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

See more information about CVE-2011-2694 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	2.6	Base Metrics:	AV:N/AC:H/Au:N/C:N/I:P/A:N
Access Vector:	Network	Attack Complexity:	High
Authentication:	None required	Confidentiality Impact:	None
Integrity Impact:	Partial	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 4 (samba)	ELSA-2011-1219	2011-08-29
Oracle Linux version 5 (samba)	ELSA-2011-1219	2011-08-29
Oracle Linux version 5 (samba3x)	ELSA-2011-1220	2011-08-29
Oracle Linux version 6 (cifs-utils)	ELSA-2011-1221	2011-08-29
Oracle Linux version 6 (samba)	ELSA-2011-1221	2011-08-29

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team