PT-2002-1508 · Bg · Bg Guestbook

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0457

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BG GuestBook version 1.0

Description A cross-site scripting issue allows remote attackers to execute arbitrary Javascript via encoded tags such as <, >, and & in fields like name, email, AIM screen name, website, location, or message.

Recommendations For BG GuestBook version 1.0, consider validating and sanitizing user input in the affected fields to prevent the execution of arbitrary Javascript code. As a temporary workaround, restrict user input to prevent the use of encoded tags.

Fix

Related Identifiers

CVE-2002-0457

Affected Products

Bg Guestbook

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-0457 · Security Note
• http://iss.net/security_center/static/8474.php · Vendor Advisory
• http://securityfocus.com/bid/4308 · Vendor Advisory
• http://securityfocus.com/archive/1/262693 · Vendor Advisory