PT-2002-2386 · Mambo · Mambo Site Server

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1662

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo Site Server version 4.0.11

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary scripts on other clients. The vulnerabilities can be exploited via the "search.php" API endpoint and the "Your name" field during account registration.

Recommendations For Mambo Site Server version 4.0.11, consider disabling the search functionality in "search.php" and restricting input in the "Your name" field during account registration to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1662

Affected Products

Mambo Site Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1662 · Security Note
• http://securityfocus.com/bid/6386 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10859 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-12/0111.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10854 · Note