CVE-2013-5300

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-15 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.

Affected products

Alienvault Open Source Security Information Management: through 4.2.3; 1.0.4, 1.0.6, 2.1, 2.1.2, 2.1.5, 2.1.5-1 (+13)

References

http://forums.alienvault.com/discussion/1609/patch-release-4-3-1
http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html
http://secunia.com/advisories/54264
http://secunia.com/advisories/54287
http://www.osvdb.org/show/osvdb/95813
http://www.osvdb.org/show/osvdb/95814
http://www.osvdb.org/show/osvdb/95816
http://www.osvdb.org/show/osvdb/95817
http://www.osvdb.org/show/osvdb/95818
http://www.securityfocus.com/bid/61456
https://exchange.xforce.ibmcloud.com/vulnerabilities/85994
http://forums.alienvault.com/discussion/1609/patch-release-4-3-1

Get alerted when CVE-2013-5300 or the next vulnerability affects your stack