CVE:CVE-2012-2960
CNNVD:CNNVD-201208-051
HP Arcsight是惠普旗下的安全软件和合规性管理解决方案公司。
HP Arcsight多个产品中的导出功能中存在跨站脚本漏洞，该漏洞源于对用户提供的输入未经充分验证。攻击者可利用该漏洞在受影响网站上下文中不知情受害者的浏览器中执行任意脚本代码，窃取基于cookie的认证证书或控制网站传达给用户的方式，也可能存在其他攻击。以下产品中存在漏洞：Arcsight Connector Appliance 6.2.0.6244.0版本和Arcsight Logger Appliance 5.2.0.6288.0版本。
solution:Upgrade hp arcsight_connector_appliance_firmware to a higher version than 6.0.0.60023.2,6.2.0.6244.0,and avoid the version 6.0.0.60023.2,6.2.0.6244.0; Upgrade hp arcsight_connector_appliance to a higher version than c1400,c3400,c5400,and avoid the version c1400,c3400,c5400; Upgrade hp arcsight_logger_appliance_firmware to a higher version than 5.2.0.6288.0,and avoid the version 5.2.0.6288.0; Upgrade hp arcsight_logger_appliance to a higher version than l7400-san,and avoid the version l7400-san