PT-2002-2575 · Unknown · Mynewsgroups

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1853

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyNewsGroups versions 0.4 through 0.4.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post. This is due to improper handling by several scripts, including "myarticles.php", "search.php", "stats.php", and "standard.lib.php".

Recommendations For MyNewsGroups versions 0.4 through 0.4.1, consider disabling the subject field in newsgroup posts until a patch is available to prevent arbitrary web script or HTML injection. Restrict access to the affected scripts, such as "myarticles.php", "search.php", "stats.php", and "standard.lib.php", to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-1853

Produtos afetados

Mynewsgroups

Referências · 5

• http://securityfocus.com/bid/5836 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-1853 · Nota de Segurança
• http://iss.net/security_center/static/10238.php · Correção
• http://securityfocus.com/archive/1/293564 · Nota
• http://secunia.com/advisories/7177 · Aviso do Fabricante