PT-2007-2837 · Woltlab · Woltlab Burning Board+1

Publicado 2007-03-14 · Atualizado 2018-10-16 · CVE-2007-1443

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Woltlab Burning Board versions 2.3.6 Burning Board Lite version 1.0.2pl3e

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in the register.php file. A third-party researcher has disputed some of the vectors, stating that only the r dateformat and r timeformat parameters in Burning Board 2.3.6 are affected.

Recommendations For Woltlab Burning Board version 2.3.6, consider disabling the register.php file or restricting access to it until a patch is available. For Burning Board Lite version 1.0.2pl3e, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-1443

Produtos afetados

Burning Board Lite

Woltlab Burning Board

Referências · 8

• http://securityreason.com/securityalert/2424 · Nota
• http://secunia.com/advisories/24386 · Aviso do Fabricante
• http://secunia.com/advisories/24404 · Aviso do Fabricante
• http://securityfocus.com/archive/1/461737/100/100/threaded · Nota
• http://vupen.com/english/advisories/2007/0856 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1443 · Nota de Segurança
• http://securityfocus.com/archive/1/461744/100/100/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1443 · Nota