PT-2006-2766 · Phpbb · Phpbb

Publicado 2006-04-13 · Atualizado 2008-09-05 · CVE-2006-1775

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.19

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several fields, including the Site Description field in admin board.php, the Group name and Group description fields in admin groups.php and groupcp.php, the Theme Name field in admin styles.php, and the Rank Title field in admin ranks.php.

Recommendations For phpBB version 2.0.19, update to a version that includes a fix for these XSS vulnerabilities to prevent remote attackers from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the affected fields, such as the Site Description field, Group name, Group description, Theme Name, and Rank Title fields, until a patch is available.

Correção

Identificadores relacionados

CVE-2006-1775

Produtos afetados

Phpbb

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1775 · Nota
• http://osvdb.org/24357 · Nota
• http://osvdb.org/ref/24/24353-phpbb.txt · Nota
• http://osvdb.org/24356 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1775 · Nota de Segurança
• http://osvdb.org/24354 · Nota
• http://osvdb.org/24355 · Nota