CVE-2013-4653

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 8660 My Teamwork before 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) before 6.7, Omnitouch 8460 Advanced Communication Server before 9.1, and OmniTouch 8400 Instant Communications Suite before 6.7.3 (1) allow remote attackers to inject arbitrary web script or HTML via a crafted URL that results in a reflected XSS or (2) allow user-assisted remote attackers to inject arbitrary web script or HTML via a user's personal bookmark entry that results in a stored XSS via unspecified vectors.

Múltiples vulnerabilidades XSS en la funcionalidad de firmado de ics en los servicios MyTeamwork en Alcatel-Lucent Omnitouch 8660 My Teamwork anterior a 6.7, Omnitouch 8670 Automated Message Delivery System (AMDS) anterior a 6.7, Omnitouch 8460 Advanced Communication Server anterior a 9.1, y OmniTouch 8400 Instant Communications Suite anterior a 6.7.3 (1) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través de una URL que resulta en un XSS reflejado o (2) permite a atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a través de una entrada en los favoritos que resulta en un XSS almacenado. No se han especificado los vectores.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-06-24 CVE Reserved
2013-08-20 CVE Published
2023-04-01 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (6)

URL	Tag	Source
http://osvdb.org/94810	Vdb Entry
http://osvdb.org/94811	Vdb Entry
http://www.securityfocus.com/bid/60902	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/85382	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/54000	2017-08-29
http://www3.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2013001.htm	2017-08-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Alcatel-lucent Search vendor "Alcatel-lucent"		Omnitouch 8400 Instant Communications Suite Search vendor "Alcatel-lucent" for product "Omnitouch 8400 Instant Communications Suite"				<= 6.7.2 Search vendor "Alcatel-lucent" for product "Omnitouch 8400 Instant Communications Suite" and version " <= 6.7.2"		-		Affected
Alcatel-lucent Search vendor "Alcatel-lucent"		Omnitouch 8460 Advanced Communication Server Search vendor "Alcatel-lucent" for product "Omnitouch 8460 Advanced Communication Server"				<= 9.0 Search vendor "Alcatel-lucent" for product "Omnitouch 8460 Advanced Communication Server" and version " <= 9.0"		-		Affected
Alcatel-lucent Search vendor "Alcatel-lucent"		Omnitouch 8660 My Teamwork Search vendor "Alcatel-lucent" for product "Omnitouch 8660 My Teamwork"				<= 6.6 Search vendor "Alcatel-lucent" for product "Omnitouch 8660 My Teamwork" and version " <= 6.6"		-		Affected
Alcatel-lucent Search vendor "Alcatel-lucent"		Omnitouch 8670 Automated Delivery Message Delivery System Search vendor "Alcatel-lucent" for product "Omnitouch 8670 Automated Delivery Message Delivery System"				<= 6.6 Search vendor "Alcatel-lucent" for product "Omnitouch 8670 Automated Delivery Message Delivery System" and version " <= 6.6"		-		Affected