PT-2005-2584 · Psoft · Sitestudio

Donnie Werner · Publicado 2005-05-16 · Atualizado 2017-07-11 · CVE-2005-1605

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SiteStudio version 1.6

Description A cross-site scripting (XSS) issue exists in the guestbook component, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the name field in either the psoft.guestbook.GuestBookServ in Standalone Site Studio or the E-Guest sign.pl in Integrated Site Studio with H-Sphere.

Recommendations For SiteStudio version 1.6, consider disabling the guestbook component until a patch is available to prevent exploitation. Restrict access to the psoft.guestbook.GuestBookServ and E-Guest sign.pl to minimize the risk of XSS attacks. Avoid using the name field in the affected guestbook component until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-1605

Produtos afetados

Sitestudio

Referências · 9

• http://exploitlabs.com/files/advisories/EXPL-A-2005-008-sitestudio.txt · Correção
• http://derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0154.html · Correção
• http://secunia.com/advisories/15286 · Correção
• http://securityfocus.com/bid/13554 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20496 · Nota
• http://psoft.net/misc/hsphere_winbox_security_update_guestbook.html · Correção
• http://osvdb.org/16240 · Nota
• http://psoft.net/SS/ss_16_security_update_guestbook.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-1605 · Nota de Segurança