PT-2005-3575 · Postnuke · Postnuke

Publicado 2005-08-24 · Atualizado 2008-09-05 · CVE-2005-2689

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.760-RC4b

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the moderate parameter to the Comments module or the htmltext parameter to the html/user.php endpoint.

Recommendations For PostNuke version 0.760-RC4b, as a temporary workaround, consider restricting access to the Comments module and the html/user.php endpoint until a patch is available. Avoid using the moderate and htmltext parameters in the affected modules until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-2689

Produtos afetados

Postnuke

Referências · 5

• 🔥 https://exploit-db.com/exploits/26187 · Exploit
• 🔥 http://securityfocus.com/bid/14635 · Exploit
• 🔥 https://exploit-db.com/exploits/26188 · Exploit
• 🔥 http://securityfocus.com/archive/1/408818 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2689 · Nota de Segurança