CVE-2005-3921

Public Exploit

Description

Cross-site scripting (XSS) vulnerability in Cisco IOS Web Server for IOS 12.0(2a) allows remote attackers to inject arbitrary web script or HTML by (1) packets containing HTML that an administrator views via an HTTP interface to the contents of memory buffers, as demonstrated by the URI /level/15/exec/-/buffers/assigned/dump; or (2) sending the router Cisco Discovery Protocol (CDP) packets with HTML payload that an administrator views via the CDP status pages. NOTE: these vectors were originally reported as being associated with the dump and packet options in /level/15/exec/-/show/buffers.

2.6

CVSS

Severity: Low

CVSS 2.0 •

EPSS 1.55% Top 20%

Vendor Advisory cisco.com Vendor Advisory infohacking.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/17780	third party advisory
http://www.vupen.com/english/advisories/2005/2657	vdb entry
http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml	vendor advisory
http://secunia.com/advisories/18528	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5867	signature vdb entry
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372	third party advisory
http://www.securityfocus.com/archive/1/417916/100/0/threaded	mailing list
http://securityreason.com/securityalert/227	third party advisory
http://www.securityfocus.com/bid/15602	vdb entry exploit
http://securitytracker.com/id?1015275	vdb entry
http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.html	vendor advisory exploit
http://www.securityfocus.com/bid/16291	vdb entry

Frequently Asked Questions

What is the severity of CVE-2005-3921?: CVE-2005-3921 has been scored as a low severity vulnerability.
How to fix CVE-2005-3921?: To fix CVE-2005-3921, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-3921 being actively exploited in the wild?: It is possible that CVE-2005-3921 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.