PT-2006-3598 · Pre · Pre News Manager

Luny · Publicado 2006-05-31 · Atualizado 2018-10-18 · CVE-2006-2678

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pre News Manager version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id parameter to "index.php" and the nid parameter to several other endpoints, including "news detail.php", "email story.php", "thankyou.php", "printable view.php", "tella friend.php", and "send comments.php".

Recommendations For Pre News Manager version 1.0, consider restricting access to the id parameter in "index.php" and the nid parameter in the affected endpoints until a patch is available. As a temporary workaround, avoid using the id and nid parameters in the respective API endpoints.

Correção

Identificadores relacionados

CVE-2006-2678

Produtos afetados

Pre News Manager

Referências · 14

• http://osvdb.org/26071 · Nota
• http://osvdb.org/26067 · Nota
• http://securityreason.com/securityalert/996 · Nota
• http://secunia.com/advisories/20284 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26692 · Nota
• http://securityfocus.com/archive/1/435020/100/0/threaded · Nota
• http://osvdb.org/26070 · Nota
• http://osvdb.org/26068 · Nota
• http://securityfocus.com/bid/18333 · Nota
• http://osvdb.org/26072 · Nota
• http://vupen.com/english/advisories/2006/1990 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2678 · Nota de Segurança
• http://osvdb.org/26069 · Nota
• http://osvdb.org/26066 · Nota