PT-2010-4347 · Runcms · Runcms

John Leitch · Publicado 2010-07-23 · Atualizado 2017-08-17 · CVE-2010-2852

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions RunCms version 2.1

Description A cross-site scripting (XSS) issue exists in the Headlines module, specifically in the magpie debug.php script, which allows remote attackers to inject arbitrary web script or HTML via the url parameter when the Headlines module is enabled.

Recommendations For RunCms version 2.1, consider disabling the Headlines module until a patch is available to prevent exploitation of the XSS vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2852

Produtos afetados

Runcms

Referências · 7

• 🔥 http://osvdb.org/66244 · Exploit
• 🔥 http://securityfocus.com/bid/41551 · Exploit
• 🔥 http://cross-site-scripting.blogspot.com/2010/07/runcms-21-magpie-rss-module-reflected.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2852 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2852 · Nota
• http://secunia.com/advisories/40521 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60224 · Nota