« Volver al listado

CVE-2010-2260

Estado: ModificadaMedia (4.3)—

Multiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Gambit Design Bandwidth Meter, v0.72 y probablemente v1.2, permite a atacantes remotos ejecutar código web o HTML de su elección a través de PATH_INFO en (1) view_by_name.php o (2) view_by_ip.php en admin/. NOTA: algunas fuentes informan que el producto afectado es ShaPlus Bandwidth Meter, siendo esto incorrecto.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gambitdesign — Bandwidth Meter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2260",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-06-09T20:30:29.757",
  "references": [
    {
      "url": "http://packetstormsecurity.org/1001-exploits/bandwidthmeter-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/38012",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/10926",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55307",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/1001-exploits/bandwidthmeter-xss.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38012",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/10926",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55307",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Gambit Design Bandwidth Meter, 0.72 and possibly 1.2, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) view_by_name.php or (2) view_by_ip.php in admin/.  NOTE: some sources report that the affected product is ShaPlus Bandwidth Meter, but this is incorrect."
    },
    {
      "lang": "es",
      "value": "Multiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Gambit Design Bandwidth Meter, v0.72 y probablemente v1.2, permite a atacantes remotos ejecutar código web o HTML de su elección a través de PATH_INFO en (1) view_by_name.php o (2) view_by_ip.php en admin/.  NOTA: algunas fuentes informan que el producto afectado es ShaPlus Bandwidth Meter, siendo esto incorrecto."
    }
  ],
  "lastModified": "2026-06-16T23:20:24.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gambitdesign:bandwidth_meter:0.72:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F497A814-809A-44DA-A9D7-CCA6981106BF"
            },
            {
              "criteria": "cpe:2.3:a:gambitdesign:bandwidth_meter:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DE7BCDA-9109-4E34-B6E3-31212E7634F1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}