PT-2007-1302 · Fx-App · Fx-App

Luny · Publicado 2007-02-15 · Atualizado 2018-10-16 · CVE-2006-7023

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions fx-APP version 0.0.8.1

Description The issue allows remote attackers to inject arbitrary HTML or web script via several fields, including the search box, url, website, comment, and signature fields in the profile, and possibly a menu item. This can lead to cross-site scripting (XSS) attacks.

Recommendations For fx-APP version 0.0.8.1, consider disabling the search box and restricting input in the url, website, comment, and signature fields in the profile until a patch is available. Avoid using potentially vulnerable menu items until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-7023

Produtos afetados

Fx-App

Referências · 6

• http://securityreason.com/securityalert/2251 · Nota
• http://securityfocus.com/bid/18361 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7023 · Nota de Segurança
• http://securityfocus.com/archive/1/436691/30/4500/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27167 · Nota
• http://securityfocus.com/archive/1/469825/100/100/threaded · Nota