PT-2005-3365 · Kayako · Kayako Liveresponse

James Bercegay · Publicado 2005-12-31 · Atualizado 2016-10-18 · CVE-2005-2460

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kayako liveResponse versions 2.x

Description The issue allows remote attackers to inject arbitrary web script or HTML via the username parameter or name field when entering a session or sending a message. This can lead to cross-site scripting (XSS) attacks.

Recommendations For Kayako liveResponse versions 2.x, consider restricting the input for the username parameter and name field to prevent arbitrary web script or HTML injection until a patch is available. As a temporary workaround, restrict access to the affected session and message functionality to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-2460

Produtos afetados

Kayako Liveresponse

Referências · 8

• 🔥 http://gulftech.org/?node=research&article_id=00092-07302005 · Exploit
• 🔥 http://osvdb.org/18395 · Exploit
• 🔥 http://osvdb.org/18397 · Exploit
• 🔥 http://securityfocus.com/bid/14425 · Exploit
• 🔥 https://exploit-db.com/exploits/26051 · Exploit
• http://secunia.com/advisories/16286 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=112274359718863&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2460 · Nota de Segurança