PT-2005-3342 · Gforge · Gforge

Joxean Koret · Published 2005-08-03 · Updated 2017-07-11 · CVE-2005-2430

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GForge version 4.5

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters and fields, including forum id and group id in forum.php, project task id in task.php, id in detail.php, the text field on the search page, group id in qrs.php, form, rows, cols, or wrap parameters in notepad.php, and the login field on the login form.

Recommendations For GForge version 4.5, consider disabling the vulnerable parameters and fields, such as forum id, group id, project task id, id, and others, until a patch is available. Restrict access to the search page and login form to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints, such as /forum.php, /task.php, /detail.php, /qrs.php, and /notepad.php, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2430

DSA-1094-1

Affected Products

Gforge

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2005-2430 · Security Note
• http://debian.org/security/2006/dsa-1094 · Vendor Advisory
• http://secunia.com/advisories/16253 · Vendor Advisory
• http://securityfocus.com/bid/14405 · Note
• http://osvdb.org/18303 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21558 · Note
• http://osvdb.org/18304 · Note
• http://osvdb.org/18301 · Note
• http://marc.info/?l=bugtraq&m=112259845904350&w=2 · Note
• http://osvdb.org/18300 · Note
• http://osvdb.org/18299 · Note
• http://secunia.com/advisories/20622 · Note
• http://osvdb.org/18302 · Note