PT-2002-2717 · Postnuke · Postnuke

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-1996

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.71 and earlier

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the name parameter in "modules.php" and the catid parameter in "index.php".

Recommendations For PostNuke versions 0.71 and earlier, avoid using the name parameter in "modules.php" and the catid parameter in "index.php" until a fix is applied. As a temporary workaround, consider restricting access to "modules.php" and "index.php" to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1996

Affected Products

Postnuke

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-03/0288.html · Exploit
• http://iss.net/security_center/static/8605.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1996 · Security Note
• http://securityfocus.com/bid/4350 · Patch
• http://archives.neohapsis.com/archives/bugtraq/2002-03/0299.html · Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=524777&group_id=27927&atid=392228 · Note