Medium severity5.4NVD Advisory· Published Mar 23, 2017· Updated May 13, 2026
CVE-2015-8687
CVE-2015-8687
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
Affected products
1- cpe:2.3:a:alcatel-lucent:motive_home_device_manager:*:*:*:*:*:*:*:*Range: <=4.1.10.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- seclists.org/fulldisclosure/2016/Jan/0nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.