CVE-2012-3842

Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html	Broken Link
http://www.securityfocus.com/bid/53281	Exploit
http://www.vulnerability-lab.com/get_content.php?id=509	Exploit Third Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html	Broken Link
http://www.securityfocus.com/bid/53281	Exploit
http://www.vulnerability-lab.com/get_content.php?id=509	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:directadmin:directadmin:1.403:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-07-03 22:55

Updated : 2025-12-05 20:11

NVD link : CVE-2012-3842

Mitre link : CVE-2012-3842

CVE.ORG link : CVE-2012-3842

JSON object : View

Products Affected

directadmin

directadmin

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-3842", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-07-03T22:55:03.037", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/53281", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vulnerability-lab.com/get_content.php?id=509", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0214.html", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/53281", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vulnerability-lab.com/get_content.php?id=509", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en CMD_DOMAIN en JBMC Software DirectAdmin v1.403, permite a usuarios con ciertos privilegios autenticados remotamente, inyectar secuencias de comandos web o HTML a trav\u00e9s de los par\u00e1metros (1) select0 o (2) select8."}], "lastModified": "2025-12-05T20:11:23.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:directadmin:directadmin:1.403:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE7D19CB-461A-4CF9-BC94-5E20D9B9235A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}