PT-2007-5042 · Sitescape · Sitescape Forum

Publicado 2007-07-17 · Atualizado 2018-10-15 · CVE-2007-3807

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SiteScape Forum versions prior to 7.3

Description: The issue allows remote attackers to inject arbitrary web script or HTML via the user name field in the login procedure. This is a result of multiple cross-site scripting (XSS) vulnerabilities. XSS is a type of attack where an attacker injects malicious scripts into a website, which are then executed by the user's browser. This can lead to unauthorized access to sensitive data or taking control of the user's session.

Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the login procedure to minimize the risk of exploitation. Avoid using the user name field in the login procedure until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3807

Produtos afetados

Sitescape Forum

Referências · 8

• http://securityfocus.com/bid/24893 · Nota
• http://osvdb.org/36844 · Nota
• http://securityfocus.com/archive/1/473624/100/0/threaded · Nota
• http://scip.ch/cgi-bin/smss/showadvf.pl?id=3159 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3807 · Nota de Segurança
• http://securityreason.com/securityalert/2893 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35395 · Nota
• http://secunia.com/advisories/26065 · Correção