CVE-2015-8687: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8687?
CVE-2015-8687 is classified as a moderate severity vulnerability due to its cross-site scripting nature that can be exploited by remote attackers.
How do I fix CVE-2015-8687?
To fix CVE-2015-8687, it is recommended to upgrade Alcatel-Lucent Motive Home Device Manager to version 4.2 or later where the vulnerabilities have been addressed.
What are the potential impacts of CVE-2015-8687?
The potential impacts of CVE-2015-8687 include unauthorized access to sensitive data and the ability for attackers to execute arbitrary scripts in the context of the user's browser.
Which software versions are affected by CVE-2015-8687?
CVE-2015-8687 affects all versions of Alcatel-Lucent Motive Home Device Manager prior to version 4.2.
Can CVE-2015-8687 be exploited without user interaction?
Yes, CVE-2015-8687 can be exploited remotely without user interaction, making it particularly dangerous.