PT-2005-3262 · Hiki · Hiki

Published 2005-09-06 · Updated 2008-11-11 · CVE-2005-2336

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hiki versions 0.8.0 through 0.8.2

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via "missing pages" where the page name is not properly escaped.

Recommendations For Hiki versions 0.8.0 through 0.8.2, consider updating to a version where this issue is fixed, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to "missing pages" to minimize the risk of exploitation.

Related Identifiers

CVE-2005-2336

Affected Products

Hiki

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-2336 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2336 · Vendor Advisory
• http://hikiwiki.org/en/advisory20050804.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-2336 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-2336 · Vendor Advisory
• http://secunia.com/advisories/17075 · Note
• http://securityfocus.com/bid/15021 · Note
• http://jvn.jp/en/jp/JVN38138980/index.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2336 · Note