PT-2002-2717 · Postnuke · Postnuke

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1996

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.71 and earlier

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the name parameter in "modules.php" and the catid parameter in "index.php".

Recommendations For PostNuke versions 0.71 and earlier, avoid using the name parameter in "modules.php" and the catid parameter in "index.php" until a fix is applied. As a temporary workaround, consider restricting access to "modules.php" and "index.php" to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-1996

Produtos afetados

Postnuke

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-03/0288.html · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2002-03/0299.html · Nota
• http://iss.net/security_center/static/8605.php · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-1996 · Nota de Segurança
• http://securityfocus.com/bid/4350 · Correção
• http://sourceforge.net/tracker/index.php?func=detail&aid=524777&group_id=27927&atid=392228 · Nota