PT-2002-1545 · Websight · Websight Directory System

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0494

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSight Directory System version 0.1

Description A cross-site scripting issue allows remote attackers to execute arbitrary Javascript, potentially gaining access to the WebSight administrator. This can be achieved by submitting a new link with the malicious script in the website name.

Recommendations For WebSight Directory System version 0.1, consider validating and sanitizing user input for website names to prevent the execution of arbitrary Javascript code. As a temporary workaround, restrict access to the link submission feature until a proper fix is applied.

Fix

Related Identifiers

CVE-2002-0494

Affected Products

Websight Directory System

References · 5

• http://iss.net/security_center/static/8624.php · Patch
• http://securityfocus.com/bid/4357 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-0494 · Security Note
• http://securityfocus.com/archive/1/263914 · Note
• http://sourceforge.net/forum/forum.php?forum_id=163389 · Note