PT-2012-3540 · Kongreg8 · Kongreg8

Publicado 2012-03-19 · Atualizado 2017-08-29 · CVE-2012-1789

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kongreg8 version 1.7.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are surname and firstname in the "modules/members/addmember.php" endpoint, as well as groupdescription and groupname in the "modules/groups/addgroupform.php" endpoint.

Recommendations For Kongreg8 version 1.7.3, consider disabling the addmember.php and addgroupform.php modules until a patch is available to prevent exploitation through the surname, firstname, groupdescription, and groupname parameters. Restrict access to these modules to minimize the risk of XSS attacks. Avoid using the vulnerable parameters in the affected endpoints until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1789

Produtos afetados

Kongreg8

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-1789 · Nota de Segurança
• http://securityfocus.com/bid/52178 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73510 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0154.html · Nota