PT-2012-5053 · Open Constructor · Open Constructor

Publicado 2012-12-28 · Atualizado 2012-12-28 · CVE-2012-3870

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open Constructor version 3.12.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the name or description parameter in the objects/createobject.php file.

Recommendations For Open Constructor version 3.12.0, avoid using the name and description parameters in the objects/createobject.php file until a fix is available. As a temporary workaround, consider validating and sanitizing user input for these parameters to prevent malicious script injection.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-3870

Produtos afetados

Open Constructor

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2012-3870 · Nota de Segurança
• http://packetstormsecurity.org/files/115276/Openconstructor-CMS-3.12.0-Cross-Site-Scripting.html · Nota