PT-2003-1196 · L Forum · L-Forum

Published 2003-03-18 · Updated 2008-09-05 · CVE-2002-1459

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions L-Forum versions 2.40 and earlier

Description A cross-site scripting issue allows remote attackers to insert arbitrary script or HTML via message fields, including From, E-Mail, and Subject, when the "Enable HTML in messages" option is off.

Recommendations For L-Forum versions 2.40 and earlier, as a temporary workaround, consider disabling the "Enable HTML in messages" option and restrict user input in message fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1459

Affected Products

L-Forum

References · 6

• http://sourceforge.net/tracker/download.php?group_id=53716&atid=471343&file_id=26687&aid=579278 · Patch
• http://iss.net/security_center/static/9838.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1459 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-08/0115.html · Vendor Advisory
• http://sourceforge.net/tracker/index.php?func=detail&aid=579278&group_id=53716&atid=471343 · Vendor Advisory
• http://securityfocus.com/bid/5462 · Vendor Advisory