PT-2006-3730 · Dominios Europa · Dominios Europa Picrate

Luny · Publicado 2006-06-05 · Atualizado 2018-10-18 · CVE-2006-2812

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the name (aka nick), email, and comment boxes; and via the id parameter. This can be exploited through specific API endpoints, although the exact endpoints are not specified.

Recommendations For Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0, consider disabling the comment and user input features until a patch is available to prevent exploitation through the name, email, and comment boxes, as well as the id parameter. Restrict access to user-provided input to minimize the risk of arbitrary web script or HTML injection.

Correção

Identificadores relacionados

CVE-2006-2812

Produtos afetados

Dominios Europa Picrate

Referências · 3

• http://securityreason.com/securityalert/1032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2812 · Nota de Segurança
• http://securityfocus.com/archive/1/435599/100/0/threaded · Nota