PT-2005-3365 · Kayako · Kayako Liveresponse

James Bercegay · Published 2005-12-31 · Updated 2016-10-18 · CVE-2005-2460

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kayako liveResponse versions 2.x

Description The issue allows remote attackers to inject arbitrary web script or HTML via the username parameter or name field when entering a session or sending a message. This can lead to cross-site scripting (XSS) attacks.

Recommendations For Kayako liveResponse versions 2.x, consider restricting the input for the username parameter and name field to prevent arbitrary web script or HTML injection until a patch is available. As a temporary workaround, restrict access to the affected session and message functionality to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2460

Affected Products

Kayako Liveresponse

References · 8

• 🔥 http://gulftech.org/?node=research&article_id=00092-07302005 · Exploit
• 🔥 http://osvdb.org/18395 · Exploit
• 🔥 http://osvdb.org/18397 · Exploit
• 🔥 http://securityfocus.com/bid/14425 · Exploit
• 🔥 https://exploit-db.com/exploits/26051 · Exploit
• http://secunia.com/advisories/16286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2460 · Security Note
• http://marc.info/?l=bugtraq&m=112274359718863&w=2 · Note