PT-2004-3514 · Wackowiki · Wackowiki

Published 2004-12-31 · Updated 2017-07-20 · CVE-2004-2624

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WackoWiki version 3.5

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the phrase parameter in the "TextSearch" functionality.

Recommendations For WackoWiki version 3.5, consider restricting access to the "TextSearch" function until a fix is available, and avoid using the phrase parameter in this context to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2624

Affected Products

Wackowiki

References · 6

• http://secunia.com/advisories/12209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2624 · Security Note
• http://osvdb.org/8295 · Patch
• http://securityfocus.com/bid/10860 · Patch
• http://wackowiki.com/WackoDownload/VersionHistory?v=yrv · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16878 · Note