PT-2010-3665 · Joomla · Com Activehelper Livehelp

Publicado 2010-05-25 · Atualizado 2010-05-26 · CVE-2010-2046

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions com activehelper livehelp version 2.0.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the DOMAINID parameter to "server/cookies.php" and the SERVER parameter to "server/index.php" are vulnerable.

Recommendations For version 2.0.3, consider disabling access to the "server/cookies.php" and "server/index.php" endpoints until a patch is available. Restrict the use of the DOMAINID and SERVER parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2046

Produtos afetados

Com Activehelper Livehelp

Referências · 6

• 🔥 http://packetstormsecurity.org/1005-exploits/joomlaactivehelper-xss.txt · Exploit
• 🔥 http://xenuser.org/2010/05/19/joomla-component-activehelper-livehelp-xss-vulnerabilities · Exploit
• 🔥 http://xenuser.org/documents/security/joomla_com_activehelper_livehelp_xss.txt · Exploit
• http://securityfocus.com/bid/40278 · Nota
• http://secunia.com/advisories/39870 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2046 · Nota de Segurança