PT-2012-2153 · Unknown · Banana Dance

CVE-2011-5176 · Publicado 2012-09-15 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Banana Dance versions prior to B.1.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the q or category parameters in the "search.php" file.

Recommendations For versions prior to B.1.5, consider restricting access to the vulnerable "search.php" file until a patch is available. As a temporary workaround, avoid using the q and category parameters in the affected API endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-5176

Produtos afetados

Banana Dance

Referências · 3

• http://bananadance.org/Program-News/Minor-Update-and-New-Theme · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5176 · Nota de Segurança
• http://doyoubananadance.com/Program-News/Important-Notice-About-SQLi-Exploit · Nota