PT-2006-1977 · Webinsta · Webinsta Limbo

Publicado 2006-02-28 · Atualizado 2017-07-20 · CVE-2006-0934

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions webinsta Limbo version 1.0.4.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via the message field in the "Contact Form" API endpoint. This can lead to cross-site scripting (XSS) attacks.

Recommendations For webinsta Limbo version 1.0.4.2, consider disabling the Contact Form until a patch is available to prevent exploitation. Restrict access to the message field in the Contact Form to minimize the risk of XSS attacks.

Correção

Identificadores relacionados

CVE-2006-0934

Produtos afetados

Webinsta Limbo

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/24877 · Nota
• http://osvdb.org/23469 · Nota
• http://secunia.com/advisories/18723 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0934 · Nota de Segurança
• http://osvdb.org/ref/23/23469-limbo.txt · Nota
• http://securityfocus.com/bid/16811 · Nota
• http://vupen.com/english/advisories/2006/0721 · Nota