FKIE_CVE-2013-2136

Vulnerability from fkie_nvd - Published: 2013-08-19 23:55 - Updated: 2026-06-16 23:52
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified "multi-edit fields;" and (6) unspecified "list view" edit fields related to global settings.
References
secalert@redhat.comhttp://archives.neohapsis.com/archives/bugtraq/2013-08/0034.html
secalert@redhat.comhttp://archives.neohapsis.com/archives/bugtraq/2013-08/0047.html
secalert@redhat.comhttp://osvdb.org/96074
secalert@redhat.comhttp://osvdb.org/96075
secalert@redhat.comhttp://osvdb.org/96076
secalert@redhat.comhttp://osvdb.org/96077
secalert@redhat.comhttp://osvdb.org/96078
secalert@redhat.comhttp://secunia.com/advisories/54399Vendor Advisory
secalert@redhat.comhttp://www.securityfocus.com/bid/61638
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/86258
secalert@redhat.comhttps://issues.apache.org/jira/browse/CLOUDSTACK-2936
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2013-08/0034.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2013-08/0047.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/96074
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/96075
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/96076
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/96077
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/96078
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/54399Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/61638
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/86258
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/jira/browse/CLOUDSTACK-2936
Impacted products
Vendor Product Version
apache cloudstack *
apache cloudstack 2.0
apache cloudstack 2.0.1
apache cloudstack 2.1.0
apache cloudstack 2.1.1
apache cloudstack 2.1.2
apache cloudstack 2.1.3
apache cloudstack 2.1.4
apache cloudstack 2.1.5
apache cloudstack 2.1.6
apache cloudstack 2.1.7
apache cloudstack 2.1.8
apache cloudstack 2.1.9
apache cloudstack 2.1.10
apache cloudstack 2.2.0
apache cloudstack 2.2.1
apache cloudstack 2.2.2
apache cloudstack 2.2.3
apache cloudstack 2.2.5
apache cloudstack 2.2.6
apache cloudstack 2.2.7
apache cloudstack 2.2.8
apache cloudstack 2.2.9
apache cloudstack 2.2.11
apache cloudstack 2.2.12
apache cloudstack 2.2.13
apache cloudstack 2.2.14
apache cloudstack 3.0.0
apache cloudstack 3.0.1
apache cloudstack 3.0.2
apache cloudstack 4.0.0
apache cloudstack 4.0.1
apache cloudstack 4.0.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "905B72D5-B6A2-4A63-80F1-F7411706B75C",
              "versionEndIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.0:-:community:*:*:*:*:*",
              "matchCriteriaId": "07DDD585-19E2-473A-B1A8-25BB3129D0C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D0AA4AC-3101-4012-AA43-7583CB077C59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5F52-CBCF-47AC-A94A-980EF65841CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "14E0EF07-41E0-40E7-A0B4-210294118B5E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4CF7900-A67B-4779-9F04-9C35B1460D89",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "355A13B2-73AB-4AA2-9EE7-AD588D5EE68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC0583FF-C928-440E-894C-CB3EC2327444",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "170F57A6-1FCE-439D-AED9-D60BCD9006EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD2B711E-E37E-4D76-96E2-B2575B9B165E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AC25A79-5B91-4BAC-A419-B1C7F20133FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "00E46243-C2DF-4448-B559-7AB4B8043CD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "08F17588-845E-4C52-AB03-E939C7CCEDE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7F77294-6AD9-4BEF-9B84-84067A8F4925",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C067A21-0F97-4FB1-9D5B-65DADD589E56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B321CA2-39D8-4DC6-843F-38BE3DBAE795",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0601E746-2144-4AEC-A2A3-F35A67EC7AD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F738C7C1-84B7-4E16-8F1A-4ACF3FE90A12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BA7376F-6160-4DDB-B0C3-D68719519256",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3FBF487-4528-4453-82D8-B10388FB6487",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EFDB749-57D9-4C81-A0BC-751F97183F61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "7882F0F9-EF9E-48BB-B609-2D3BAC089A92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3D50D8C-1739-4A08-891B-752F5048E1B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E4F87FA-CE60-4BBE-AB61-4CDB76DE6C65",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "E640A1C1-4B65-4978-B4CA-A1049B5C9443",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C539879-5EC9-4BA7-9FE1-B93933D77FA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:2.2.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "836EF10E-6F1D-4E7A-B41C-34C5CD246C17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C09B6538-02FB-4AC8-9F1B-AAAE7A9BE6C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "518BB162-8FAD-4B73-87B0-604EA84B3DB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C68CF8F3-D31B-4CDB-91C9-0334012C7CE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:4.0.0:incubating:*:*:*:*:*:*",
              "matchCriteriaId": "EA46B1B9-FCD7-4F3D-88E6-95B1A5A0497C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C96C7798-F716-44DA-A57F-3103E001236B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "737C672C-D820-41B9-88E3-97DC113D9290",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone wizard; (2) New network name, (3) instance name, or (4) group to the Instance wizard; (5) unspecified \"multi-edit fields;\" and (6) unspecified \"list view\" edit fields related to global settings."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades XSS en Apache CloudStack 4.1.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s de (1) un nombre f\u00edsico de  red mediante el asistente de zona, (2) un nombre nuevo de red, (3) un nombre de instancia o (4) grupo en el asistente de instancias; (5) campos \"multiedit\" sin especificar y (6) campos editables del tipo \"list view\" sin especificar relacionados con los par\u00e1metros globales."
    }
  ],
  "id": "CVE-2013-2136",
  "lastModified": "2026-06-16T23:52:48.803",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-08-19T23:55:08.333",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-08/0034.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-08/0047.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/96074"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/96075"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/96076"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/96077"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/96078"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/54399"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/61638"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86258"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://issues.apache.org/jira/browse/CLOUDSTACK-2936"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-08/0034.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2013-08/0047.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/96074"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/96075"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/96076"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/96077"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/96078"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/54399"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/61638"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86258"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.apache.org/jira/browse/CLOUDSTACK-2936"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.