PT-2005-1941 · Cpg · Cpg Dragonfly

Published 2005-03-26 · Updated 2008-09-05 · CVE-2005-0914

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CPG Dragonfly version 9.0.2.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the profile parameter to "index.php" or the cat parameter.

Recommendations For CPG Dragonfly version 9.0.2.0, consider restricting access to the "index.php" endpoint and avoid using the profile and cat parameters until a fix is available. As a temporary workaround, restrict the ability to inject web script or HTML via these parameters to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-0914

Affected Products

Cpg Dragonfly

References · 3

• http://security.talte.net/content/view/252/46 · Vendor Advisory
• http://securitytracker.com/id?1013573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0914 · Security Note