PT-2004-2764 · Bblog · Bblog

Published 2004-03-26 · Updated 2020-12-08 · CVE-2004-1865

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions bBlog version 0.7.2

Description A cross-site scripting (XSS) issue exists in the administration panel, allowing remote authenticated users with superuser privileges to inject arbitrary web script or HTML via the blogname variable. This issue may not be considered a vulnerability if administrators are normally allowed to add HTML through other means.

Recommendations For bBlog version 0.7.2, consider restricting the ability to inject HTML via the blog name to prevent potential exploitation, or ensure that administrators are not allowed to add HTML through other means, thus minimizing the risk associated with this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2004-1865

Affected Products

Bblog

References · 6

• 🔥 http://securitytracker.com/id?1009564 · Exploit
• 🔥 http://marc.info/?l=bugtraq&m=108034226717745&w=2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1865 · Security Note
• http://osvdb.org/10510 · Note
• http://securityfocus.com/bid/13397 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15635 · Note