CVE-2006-5741
Summary
| CVE | CVE-2006-5741 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-11-06 18:07:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise before 7.5 build 6307 allow remote attackers to inject arbitrary web script or HTML via (1) the 404 error page of the Smart Sensor Edge Sensor; (2) the user name for a failed logon, when displayed in the audit journals reviewing interface (/AirMagnetSensor/AMSensor.dll/XH) by the Smart Sensor Edge Sensor log viewer; and (3) an SSID of an AP, when displayed on an ACL page (/Amom/Amom.dll/BD) of the Enterprise Server Status Overview in the Enterprise Server Web interface. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:N/I:P/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Airmagnet | Enterprise | 7.5 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| www.osvdb.org/29919 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| Airmagnet Enterprise Management Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| www.osvdb.org/29918 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| AirMagnet Enterprise Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| www.osvdb.org/29920 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| AirMagnet | 2007-08-17 | Tony Ho | - Affected AirMagnet Builds: AirMagnet Enterprise 7.5 build 6289 and earlier. - Vulnerability Description: Intruders can execute a script in the Internet Explorer browser using symbols/script in the SSID generated by a fake access point. In the AirMagnet Enterprise system, such a script can be executed from the Sensor webpage or the AirWISE page in the AirMagnet Enterprise Console. This attack will not cause any damage to the AirMagnet Enterprise Server and no data will be lost or stolen. The intruder could potentially impact the performance of the machine running the Enterprise Console software. This is a known vulnerability in Internet Explorer and only works if users have enabled DirectX to execute scripts inside of Internet Explorer. - AirMagnet Solution: Listing SSIDs within quotes (“ “) will fix the problem. Customers should also be encouraged to not allow DirectX scripts in IE. - Fix Availability: Patch currently available on MyAirMagnet. Customers should upgrade to the latest version available on MyAirMagnet. Customers running a version of AirMagnet older than 6.1 must upgrade to version 6.1 before upgrading to the current release. Customers can contact AirMagnet Support to obtain the 6.1 release. |
There are currently no legacy QID mappings associated with this CVE.