Home > Vulnerability Database > CVE-2011-2694

Mend.io Vulnerability Database

CVE-2011-2694

Date: July 29, 2011

Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).

Severity Score

3.7

Related Resources (21)

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/68844

Url: http://samba.org/samba/history/samba-3.5.10.html

Url: http://jvn.jp/en/jp/JVN63041502/index.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=722537

Url: http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543

Url: http://www.securityfocus.com/bid/48901

Url: http://www.debian.org/security/2011/dsa-2290

Url: http://osvdb.org/74072

Url: http://secunia.com/advisories/45488

Url: http://securitytracker.com/id?1025852

Url: http://secunia.com/advisories/45496

Url: https://bugzilla.samba.org/show_bug.cgi?id=8289

Url: http://ubuntu.com/usn/usn-1182-1

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-2694

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2011-2694

Url: https://security-tracker.debian.org/tracker/CVE-2011-2694

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:121

Url: http://secunia.com/advisories/45393

Url: https://access.redhat.com/security/cve/CVE-2011-2694

Url: http://www.samba.org/samba/security/CVE-2011-2694

Url: https://www.mend.io/vulnerability-database/CVE-2011-2694

Severity Score

3.7

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	2.6
Access Vector (AV):	NETWORK
Access Complexity (AC):	HIGH
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-2694

Date: July 29, 2011

Severity Score

Related Resources (21)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?