PT-2007-2572 · Kayako · Esupport

Doz · Publicado 2007-02-27 · Atualizado 2018-10-16 · CVE-2007-1145

NVD

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php, (3) unspecified vectors in the Submit form in a submit action in index.php, and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412, CVE-2005-0487, or CVE-2005-0842.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-1145

Produtos afetados

Esupport

Referências · 9

• http://osvdb.org/33536 · Nota
• http://securityfocus.com/archive/1/460591/100/0/threaded · Nota
• http://osvdb.org/33535 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1145 · Nota
• http://vupen.com/english/advisories/2007/0717 · Nota
• http://securityreason.com/securityalert/2335 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1145 · Nota de Segurança
• http://secunia.com/advisories/24223 · Aviso do Fabricante
• http://securityfocus.com/bid/22631 · Nota