PT-2002-1545 · Websight · Websight Directory System

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0494

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSight Directory System version 0.1

Description A cross-site scripting issue allows remote attackers to execute arbitrary Javascript, potentially gaining access to the WebSight administrator. This can be achieved by submitting a new link with the malicious script in the website name.

Recommendations For WebSight Directory System version 0.1, consider validating and sanitizing user input for website names to prevent the execution of arbitrary Javascript code. As a temporary workaround, restrict access to the link submission feature until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2002-0494

Produtos afetados

Websight Directory System

Referências · 5

• http://iss.net/security_center/static/8624.php · Correção
• http://securityfocus.com/archive/1/263914 · Nota
• http://securityfocus.com/bid/4357 · Correção
• http://sourceforge.net/forum/forum.php?forum_id=163389 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0494 · Nota de Segurança