PT-2006-6645 · Helm · Helm Web Hosting Control Panel

Publicado 2006-11-20 · Atualizado 2018-10-17 · CVE-2006-5984

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Helm Web Hosting Control Panel version 3.2.10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The affected parameters include txtCompanyName, txtEmail, txtUserAccNum, and setThemeColour. The vulnerable API endpoints are "users.asp" and "default.asp" at the Reseller, Admin, and User levels.

Recommendations For Helm Web Hosting Control Panel version 3.2.10, consider restricting access to the txtCompanyName, txtEmail, txtUserAccNum, and setThemeColour parameters in the affected API endpoints "users.asp" and "default.asp" until a patch is available. As a temporary workaround, avoid using these parameters in the Reseller, Admin, and User levels to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-5984

Produtos afetados

Helm Web Hosting Control Panel

Referências · 9

• http://secunia.com/advisories/22916 · Aviso do Fabricante
• http://securitytracker.com/id?1017240 · Nota
• http://vupen.com/english/advisories/2006/4557 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5984 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30309 · Nota
• http://securityfocus.com/archive/1/451848/100/200/threaded · Nota
• http://securityreason.com/securityalert/1884 · Nota
• http://securityfocus.com/archive/1/451737/100/0/threaded · Nota
• http://aria-security.net/advisory/helm.txt · Aviso do Fabricante