PT-2004-2042 · Mnogosearch · Mnogosearch

Publicado 2004-12-10 · Atualizado 2017-07-11 · CVE-2004-1059

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: mnoGoSearch versions 3.2.26 and earlier

Description: The issue allows remote attackers to inject arbitrary HTML and web script via specific search pages and forms, including the next and prev result search pages, and the extended and simple search forms.

Recommendations: For versions 3.2.26 and earlier, update to a version later than 3.2.26 to resolve the issue. As a temporary workaround, consider restricting access to the search functionality until a patch is available. Avoid using the vulnerable search forms, specifically the extended and simple search forms, until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-1059

Produtos afetados

Mnogosearch

Referências · 7

• http://mikx.de/index.php?p=6 · Aviso do Fabricante
• http://securityfocus.com/bid/11895 · Aviso do Fabricante
• http://mnogosearch.org/history.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1059 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18434 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1059 · Nota