PT-2004-2764 · Bblog · Bblog

Publicado 2004-03-26 · Atualizado 2020-12-08 · CVE-2004-1865

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions bBlog version 0.7.2

Description A cross-site scripting (XSS) issue exists in the administration panel, allowing remote authenticated users with superuser privileges to inject arbitrary web script or HTML via the blogname variable. This issue may not be considered a vulnerability if administrators are normally allowed to add HTML through other means.

Recommendations For bBlog version 0.7.2, consider restricting the ability to inject HTML via the blog name to prevent potential exploitation, or ensure that administrators are not allowed to add HTML through other means, thus minimizing the risk associated with this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2004-1865

Produtos afetados

Bblog

Referências · 6

• 🔥 http://securitytracker.com/id?1009564 · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=108034226717745&w=2 · Exploit
• http://osvdb.org/10510 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1865 · Nota de Segurança
• http://securityfocus.com/bid/13397 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15635 · Nota