PT-2007-4548 · Papoo · Papoo Light

Publicado 2007-06-19 · Atualizado 2018-10-16 · CVE-2007-3269

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Papoo Light version 3.6 before 20070611

Description The issue allows remote attackers to inject arbitrary web script or HTML via the URI in a GET request or the Title field of a visitor comment. Additionally, remote authenticated users can inject arbitrary web script or HTML via a message to another user.

Recommendations For Papoo Light version 3.6 before 20070611, update to a version released after 20070611 to resolve the issue. As a temporary workaround, consider restricting user input in the Title field of visitor comments and limiting the ability to send messages to other users. Avoid using the URI in a GET request with untrusted input until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-3269

Produtos afetados

Papoo Light

Referências · 10

• 🔥 http://securityfocus.com/bid/24494 · Exploit
• http://securityreason.com/securityalert/2825 · Nota
• http://osvdb.org/37545 · Nota
• http://osvdb.org/37546 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34888 · Nota
• http://secunia.com/advisories/25708 · Nota
• http://papoo.de/index/menuid/204/reporeid/215 · Nota
• http://securityfocus.com/archive/1/471490/100/0/threaded · Nota
• http://osvdb.org/37544 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3269 · Nota de Segurança