PT-2007-2251 · Flashchat · Flashchat

Binaryloc · Publicado 2007-02-07 · Atualizado 2018-10-16 · CVE-2007-0807

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions flashChat version 4.7.8

Description A cross-site scripting (XSS) issue exists due to improper handling of the channel title, also known as the room name, by the "who's online" feature. This allows remote attackers to inject arbitrary web script or HTML.

Recommendations For flashChat version 4.7.8, ensure that user input for channel titles is properly sanitized to prevent XSS attacks. As a temporary workaround, consider restricting the ability to create or edit channel titles until a fix is available.

Correção

Identificadores relacionados

CVE-2007-0807

Produtos afetados

Flashchat

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0807 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32208 · Nota
• http://securityfocus.com/bid/22411 · Nota
• http://secunia.com/advisories/24071 · Nota
• http://vupen.com/english/advisories/2007/0495 · Nota
• http://securityreason.com/securityalert/2228 · Nota
• http://securityfocus.com/archive/1/459160/100/0/threaded · Nota