PT-2007-1047 · Just For Fun · Jffnms

Publicado 2007-06-12 · Atualizado 2018-10-16 · CVE-2007-3189

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Just For Fun Network Management System (JFFNMS) version 0.8.3

Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the user parameter in the auth.php file. Multiple vulnerabilities in the jffnms package may lead to confidentiality and integrity breaches, and can be exploited remotely.

Recommendations: For Just For Fun Network Management System (JFFNMS) version 0.8.3, consider disabling the auth.php file or restricting access to it until a patch is available. Avoid using the user parameter in the affected auth.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

BDU:2015-04130

CVE-2007-3189

DSA-1374-1

Produtos afetados

Jffnms

Referências · 13

• 🔥 https://exploit-db.com/exploits/30172 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3191 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3189 · Nota de Segurança
• http://marc.info/?l=full-disclosure&m=118151087109711&w=2 · Nota
• http://debian.org/security/2007/dsa-1374 · Aviso do Fabricante
• http://securityfocus.com/bid/24414 · Nota
• http://securityfocus.com/archive/1/471039/100/0/threaded · Nota
• https://bdu.fstec.ru/vul/2015-04130 · Nota de Segurança
• http://debian.org/security/dsa-1374 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3189 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3190 · Nota de Segurança
• http://secunia.com/advisories/26769 · Nota
• http://secunia.com/advisories/25587 · Nota