Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings.
References
- apache-cloudstack-cve20132136-xss(86258) vdb-entry
- 61638 vdb-entry
- 96078 vdb-entry
- 20130806 [CVE-2013-2136] Apache CloudStack Cross-site scripting (XSS) vulnerabiliity mailing-list
- 20130807 Updated [CVE-2013-2136] Apache CloudStack Cross-site scripting (XSS) vulnerabiliity mailing-list
- 96074 vdb-entry
- 96076 vdb-entry
- https://issues.apache.org/jira/browse/CLOUDSTACK-2936
- 96075 vdb-entry
- 96077 vdb-entry
- 54399 third-party-advisory