FKIE_CVE-2013-6923

Vulnerability from fkie_nvd - Published: 2014-01-09 18:55 - Updated: 2026-06-17 00:01
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname parameter to admin/access_control_user_edit.php or (2) workname parameter to admin/network_workgroup_domain.php.
References
cve@mitre.orghttp://packetstormsecurity.com/files/124685Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/30727Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/90111
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/124685Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/30727Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/90111
Impacted products
Vendor Product Version
seagate blackarmor_nas_220_firmware sg2000-2000.1331
seagate blackarmor_nas_220 st320005lsa10g-rk
seagate blackarmor_nas_220 st340005lsa10g-rk
seagate blackarmor_nas_220 stav6000100
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:seagate:blackarmor_nas_220_firmware:sg2000-2000.1331:*:*:*:*:*:*:*",
              "matchCriteriaId": "99E562A1-2345-4D30-9AE1-2CA8731F21B0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:seagate:blackarmor_nas_220:st320005lsa10g-rk:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A12C2D2-D210-409F-9121-F5307466CD0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:seagate:blackarmor_nas_220:st340005lsa10g-rk:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BC0CC4C-D27F-4CF6-A789-8BD8020795C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:seagate:blackarmor_nas_220:stav6000100:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBB53E0C-3722-4E42-8981-B2083EFDC6BE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname parameter to admin/access_control_user_edit.php or (2) workname parameter to admin/network_workgroup_domain.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades cross-site scripting (XSS) en dispositivos Seagate BlackArmor NAS 220 con firmware sq2000-2000.1331 permite a atacantes remotos inyectar script web o HTML a trav\u00e9s del par\u00e1metro (1) fullname en admin/access_control_user_edit.php o (2) workname en admin/network_workgroup_domain.php"
    }
  ],
  "id": "CVE-2013-6923",
  "lastModified": "2026-06-17T00:01:08.200",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-01-09T18:55:08.150",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/124685"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/30727"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90111"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/124685"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/30727"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90111"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.