PT-2008-3735 · Blosxom · Blosxom

Yoshinori Ohta · Publicado 2008-10-03 · Atualizado 2017-08-08 · CVE-2008-2236

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Blosxom versions prior to 2.1.2

Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the flav parameter, which is related to the flavour variable. This can be exploited by sending malicious input to the /blosxom.cgi endpoint.

Recommendations: For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the flav parameter in the blosxom.cgi endpoint to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2236

Produtos afetados

Blosxom

Referências · 10

• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2236 · Aviso do Fabricante
• http://secunia.com/advisories/32074 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-2236 · Aviso do Fabricante
• http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000073.html · Nota
• http://sourceforge.net/project/shownotes.php?release_id=630149 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2236 · Nota de Segurança
• http://jvn.jp/en/jp/JVN03300113/index.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45600 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-2236 · Aviso do Fabricante
• http://securityfocus.com/bid/31535 · Nota