PT-2002-2575 · Unknown · Mynewsgroups

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1853

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyNewsGroups versions 0.4 through 0.4.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the subject of a newsgroup post. This is due to improper handling by several scripts, including "myarticles.php", "search.php", "stats.php", and "standard.lib.php".

Recommendations For MyNewsGroups versions 0.4 through 0.4.1, consider disabling the subject field in newsgroup posts until a patch is available to prevent arbitrary web script or HTML injection. Restrict access to the affected scripts, such as "myarticles.php", "search.php", "stats.php", and "standard.lib.php", to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1853

Affected Products

Mynewsgroups

References · 5

• http://securityfocus.com/bid/5836 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1853 · Security Note
• http://iss.net/security_center/static/10238.php · Patch
• http://secunia.com/advisories/7177 · Vendor Advisory
• http://securityfocus.com/archive/1/293564 · Note