PT-2003-1196 · L Forum · L-Forum

Publicado 2003-03-18 · Atualizado 2008-09-05 · CVE-2002-1459

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions L-Forum versions 2.40 and earlier

Description A cross-site scripting issue allows remote attackers to insert arbitrary script or HTML via message fields, including From, E-Mail, and Subject, when the "Enable HTML in messages" option is off.

Recommendations For L-Forum versions 2.40 and earlier, as a temporary workaround, consider disabling the "Enable HTML in messages" option and restrict user input in message fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1459

Produtos afetados

L-Forum

Referências · 6

• http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278 · Correção
• http://iss.net/security_center/static/9838.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1459 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.html · Aviso do Fabricante
• http://sourceforge.net/tracker/index.php?func=detail&aid=579278&group_id=53716&atid=471343 · Aviso do Fabricante
• http://securityfocus.com/bid/5462 · Aviso do Fabricante