PT-2011-4790 · Lightneasy · Lightneasy

Publicado 2011-10-04 · Atualizado 2018-10-09 · CVE-2011-3978

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions LightNEasy version 3.2.4

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific parameters in a sendcomment action for the news page. The vulnerable parameters are commentemail, commentmessage, and commentname.

Recommendations For LightNEasy version 3.2.4, consider restricting access to the sendcomment action for the news page until a fix is available, and avoid using the parameters commentemail, commentmessage, and commentname in this action to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3978

Produtos afetados

Lightneasy

Referências · 9

• 🔥 http://lightneasy.org/punbb/viewtopic.php?id=1464 · Exploit
• 🔥 http://rul3z.de/advisories/SSCHADV2011-013.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69737 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3978 · Nota de Segurança
• http://secunia.com/advisories/45955 · Aviso do Fabricante
• http://osvdb.org/75262 · Nota
• http://securityfocus.com/archive/1/519571/100/0/threaded · Nota
• http://securityreason.com/securityalert/8407 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3978 · Nota