« Volver al listado

CVE-2010-0460

Estado: ModificadaBaja (3.5)—

Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion action. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Kayako — EsupportKayako — Supportsuite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0460",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-01-28T20:30:01.777",
  "references": [
    {
      "url": "http://osvdb.org/61928",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/1001-advisories/kayako-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/38322",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/509122/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/37947",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55859",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/61928",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.org/1001-advisories/kayako-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38322",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/509122/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/37947",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55859",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion action.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en  staff/index.php en Kayako SupportSuite v3.60.04 y anteriores permite a usuarios remotos autenticados inyectar secuencias arbitrarias de comandos web o HTML a través de los parámetros (1) \"subject\" y (2) \"contents\" (también conocido como \"body\") en una acción insertquestion. NOTA: La procedencia de esta información es desconocida, los detalles fueron obtenidos de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:16:13.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kayako:esupport:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F648C9B1-D21E-4B1B-9F72-779B497D73C3",
              "versionEndIncluding": "3.60.04"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FA8EFAF-3034-4546-94E5-31B2B3FE0E2A"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.00.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "306A4240-7895-4B3F-B8FC-91F76DAA4ADE"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.00.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCCD5F81-495F-4433-86BD-2F2AA7696334"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.10.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9C022D3-42ED-442E-9125-E0EAA8E74705"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.10.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FC5A1D5-8831-4032-92D8-DD490CC28774"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.11.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "878901B9-06F2-49ED-A035-1BD86BB5F11D"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.11.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F297ABB-E65C-4BBF-B846-AFCC5A572540"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.20.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97A653BB-E814-4194-B911-CB3F6B69F5A9"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.30:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68CB9C07-C2DC-4186-8B6E-5B902B6261D3"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.30:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31270F05-C038-4C7D-9592-505FE936A993"
            },
            {
              "criteria": "cpe:2.3:a:kayako:supportsuite:3.50.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92135838-7596-42DD-B04A-B8ABFF790817"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}