PT-2005-2611 · Jgs Xa · Jgs-Portal

Deluxe89 · Published 2005-05-17 · Updated 2016-10-18 · CVE-2005-1634

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JGS-XA JGS-Portal version 3.0.2 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including anzahl beitraege to "jgs portal.php", year to "jgs portal statistik.php", year to "jgs portal beitraggraf.php", tag to "jgs portal viewsgraf.php", year to "jgs portal themengraf.php", year to "jgs portal mitgraf.php", id to "jgs portal sponsor.php", or the Accept-Language header to "jgs portal log.php".

Recommendations For JGS-XA JGS-Portal version 3.0.2 and earlier, consider disabling the affected parameters, such as anzahl beitraege, year, tag, and id, until a patch is available. Additionally, restrict access to the Accept-Language header in "jgs portal log.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2005-1634

Affected Products

Jgs-Portal

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-1634 · Security Note
• http://marc.info/?l=bugtraq&m=111627681218415&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1634 · Note