Vulnerability Details : CVE-2010-1911
The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a DNS hijacking attack.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2010-1911
Probability of exploitation activity in the next 30 days: 0.29%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 64 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-1911
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2010-1911
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-1911
-
http://www.securityfocus.com/archive/1/511176/100/0/threaded
SecurityFocus
-
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
Patch;Vendor Advisory
-
http://www.wintercore.com/downloads/rootedcon_0day.pdf
404 Not FoundExploit
-
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
404 Not Found
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/58608
Consona CRM Suite SdcWebSecureBase code execution CVE-2010-1911 Vulnerability Report
-
http://www.kb.cert.org/vuls/id/602801
VU#602801 - Consona (formerly SupportSoft) Intelligent Assistance Suite (IAS) cross-site scripting, ActiveX, and Repair Service vulnerabilitiesPatch;US Government Resource
Products affected by CVE-2010-1911
- cpe:2.3:a:consona:consona_live_assistance:*:*:*:*:*:*:*:*
- cpe:2.3:a:consona:consona_dynamic_agent:-:-:enterprise:*:*:*:*:*
- cpe:2.3:a:consona:consona_dynamic_agent:-:-:marketing:*:*:*:*:*
- cpe:2.3:a:consona:consona_dynamic_agent:-:-:support:*:*:*:*:*
- cpe:2.3:a:consona:consona_subscriber_assistance:*:*:*:*:*:*:*:*