PT-2004-2557 · Phpscheduleit · Phpscheduleit

Publicado 2004-08-31 · Atualizado 2017-07-11 · CVE-2004-1651

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpScheduleIt version 1.0.0 RC1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the registration page. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including the Name field, Lastname field during new user registration, or the Schedule Name field.

Recommendations For phpScheduleIt version 1.0.0 RC1, as a temporary workaround, consider validating and sanitizing user input for the Name, Lastname, and Schedule Name fields to prevent XSS attacks. Restrict access to these fields until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-1651

Produtos afetados

Phpscheduleit

Referências · 9

• http://archives.neohapsis.com/archives/bugtraq/2004-09/0216.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1651 · Nota de Segurança
• http://osvdb.org/9451 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1651 · Nota
• http://marc.info/?l=bugtraq&m=109399590602709&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17193 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17194 · Nota
• http://securityfocus.com/bid/11080 · Aviso do Fabricante
• http://securitytracker.com/id?1011127 · Nota