CVE-2013-5911
MediumExploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Risk Assessment
An attacker can exploit XSS to execute scripts in the victim's browser, potentially leading to session theft or other attacks.
Recommendation
Upgrade SecurityCenter to a version newer than 4.7 that includes the fix.
Other vulnerabilities in Tenable SecurityCenter
See all- CVE-2018-1155Medium
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue allows an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area.
- CVE-2018-1154High
In SecurityCenter versions prior to 5.7.0, a username enumeration issue allows an unauthenticated attacker to automate discovery of username aliases via brute force, potentially facilitating unauthorized access.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.