PT-2005-4301 · Microsoft+1 · Internet Explorer+1

Andreas Sandblad · Published 2005-11-05 · Updated 2018-10-19 · CVE-2005-3505

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 10.2.0-R82 through 10.6.0-R137

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via a chat message. This is possible by including Javascript in style attributes within tags, which can be processed by Internet Explorer.

Recommendations For versions 10.2.0-R82 through 10.6.0-R137, consider disabling the Entropy Chat script as a temporary workaround until a patch is available. Restrict access to chat functionality to minimize the risk of exploitation. Avoid using style attributes in tags such as in chat messages until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3505

Affected Products

Internet Explorer

Cpanel

References · 11

• 🔥 http://secunia.com/secunia_research/2005-56/advisory · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0124.html · Exploit
• http://secunia.com/advisories/16609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3505 · Security Note
• http://securityfocus.com/bid/15327 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3505 · Note
• http://securitytracker.com/id?1015157 · Note
• http://securityreason.com/securityalert/148 · Note
• http://vupen.com/english/advisories/2005/2306 · Note
• http://osvdb.org/20459 · Note
• http://securityfocus.com/archive/1/415722/30/0/threaded · Note