PT-2011-2893 · Simple Machines · Simple Machines Forum

Norv · Publicado 2011-06-21 · Atualizado 2011-06-29 · CVE-2011-1129

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 1.1.13 Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5

Description A cross-site scripting (XSS) issue exists in the EditNews function in ManageNews.php. This could allow remote authenticated users to inject arbitrary web script or HTML via a save items action.

Recommendations For versions prior to 1.1.13, update to version 1.1.13 or later. For versions 2.x prior to 2.0 RC5, update to version 2.0 RC5 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-1129

Produtos afetados

Simple Machines Forum

Referências · 6

• http://openwall.com/lists/oss-security/2011/03/02/4 · Correção
• http://openwall.com/lists/oss-security/2011/02/22/17 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-1129 · Nota de Segurança
• http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1129 · Nota
• http://simplemachines.org/community/index.php?topic=421547.0 · Correção