PT-2008-5117 · Lussumo · Lussumo Vanilla

James Bercegay · Publicado 2008-08-21 · Atualizado 2018-10-11 · CVE-2008-3758

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lussumo Vanilla versions 1.1.4 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to "people.php". Additionally, remote authenticated users can inject arbitrary web script or HTML via the Account picture and Icon fields in "account.php".

Recommendations For versions 1.1.4 and earlier, update to a version that addresses these issues, ensuring that the NewPassword parameter in "people.php" and the Account picture and Icon fields in "account.php" are properly sanitized to prevent arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to the "people.php" and "account.php" pages until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3758

Produtos afetados

Lussumo Vanilla

Referências · 12

• 🔥 http://securityfocus.com/bid/30748 · Exploit
• 🔥 https://exploit-db.com/exploits/32279 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00126-08192008 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44554 · Nota
• http://secunia.com/advisories/31527 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3758 · Nota
• http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1 · Correção
• http://lussumo.com/docs/doku.php?id=vanilla:releasenotes · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44556 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3758 · Nota de Segurança
• http://securityreason.com/securityalert/4176 · Nota
• http://securityfocus.com/archive/1/495577/100/0/threaded · Nota