PT-2005-2611 · Jgs Xa · Jgs-Portal

Deluxe89 · Publicado 2005-05-17 · Atualizado 2016-10-18 · CVE-2005-1634

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JGS-XA JGS-Portal version 3.0.2 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including anzahl beitraege to "jgs portal.php", year to "jgs portal statistik.php", year to "jgs portal beitraggraf.php", tag to "jgs portal viewsgraf.php", year to "jgs portal themengraf.php", year to "jgs portal mitgraf.php", id to "jgs portal sponsor.php", or the Accept-Language header to "jgs portal log.php".

Recommendations For JGS-XA JGS-Portal version 3.0.2 and earlier, consider disabling the affected parameters, such as anzahl beitraege, year, tag, and id, until a patch is available. Additionally, restrict access to the Accept-Language header in "jgs portal log.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2005-1634

Produtos afetados

Jgs-Portal

Referências · 3

• http://marc.info/?l=bugtraq&m=111627681218415&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1634 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1634 · Nota