PT-2009-4560 · Webmedia · Webmedia Explorer

Publicado 2009-06-17 · Atualizado 2018-10-10 · CVE-2009-2107

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmedia Explorer (webmex) versions 5.09 through 5.10

Description The issue allows remote attackers to inject arbitrary web script or HTML via event handlers such as onmouseover in several parameters, including the search and tag parameters, arbitrary invalid parameter names, the bookmark parameter in an edit action, and the email parameter in a remember action.

Recommendations For Webmedia Explorer (webmex) versions 5.09 through 5.10, consider disabling the search and tag parameters, as well as any arbitrary invalid parameter names, until a patch is available. Restrict access to the bookmark parameter in edit actions and the email parameter in remember actions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-2107

Produtos afetados

Webmedia Explorer

Referências · 6

• 🔥 http://forum.intern0t.net/intern0t-advisories/1123-intern0t-webmedia-explorer-cross-site-scripting-vulnerability.html · Exploit
• 🔥 https://exploit-db.com/exploits/33038 · Exploit
• 🔥 http://securityfocus.com/bid/35368 · Exploit
• http://securityfocus.com/archive/1/504307/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2107 · Nota de Segurança
• http://secunia.com/advisories/35477 · Aviso do Fabricante