PT-2001-2334 · Agora · Agora

Published 2001-12-17 · Updated 2024-02-14 · CVE-2001-1199

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Agora versions 3.0a through 4.0g

Description The issue allows remote attackers to execute Javascript on other clients via the cart id parameter in agora.cgi when debug mode is enabled. This occurs because of a cross-site scripting issue.

Recommendations For Agora versions 3.0a through 4.0g, consider disabling debug mode in agora.cgi to prevent exploitation until a patch is available. Additionally, restrict access to the cart id parameter to minimize the risk of malicious script execution.

Exploit

Fix

Related Identifiers

CVE-2001-1199

Affected Products

Agora

References · 7

• 🔥 http://securityfocus.com/bid/3702 · Exploit
• 🔥 https://exploit-db.com/exploits/21184 · Exploit
• http://securityfocus.com/archive/1/246044 · Vendor Advisory
• http://iss.net/security_center/static/7708.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1199 · Security Note
• http://agoracgi.com/security.html · Note
• http://osvdb.org/698 · Note