PT-2015-5311 · My Little Forum · My Little Forum

Jing Wang · Publicado 2015-02-04 · Atualizado 2017-09-08 · CVE-2015-1475

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions my little forum versions 1.7 through 2.3.3

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page or category parameter to "forum.php" or the page or order parameter to "board entry.php" or "forum entry.php".

Recommendations For my little forum versions 1.7 through 2.3.3, update to a version that contains a fix for this issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-1475

Produtos afetados

My Little Forum

Referências · 5

• http://seclists.org/fulldisclosure/2015/Feb/15 · Nota
• http://tetraph.com/security/xss-vulnerability/my-little-forum-multiple-xss-security-vulnerabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1475 · Nota de Segurança
• http://packetstormsecurity.com/files/130220/My-Little-Forum-2.3.3-2.2-1.7-Cross-Site-Scripting.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100616 · Nota