PT-2005-3512 · Ecw · Ecw-Shop

John Cobb · Publicado 2005-08-19 · Atualizado 2016-10-18 · CVE-2005-2622

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ECW-Shop version 6.0.2

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the max or ctg parameters in the index.php file.

Recommendations For ECW-Shop version 6.0.2, as a temporary workaround, consider restricting access to the index.php file until a patch is available. Avoid using the max and ctg parameters in the index.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2622

Produtos afetados

Ecw-Shop

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-2622 · Nota de Segurança
• http://secunia.com/advisories/16459 · Nota
• http://marc.info/?l=bugtraq&m=112421209919985&w=2 · Nota
• http://securitytracker.com/id?1014734 · Nota